Skill UI

This skill acts as an expert author for creating comprehensive, implementation-ready design system guidelines. It covers foundational elements, including brand identity, color tokens, typography scales, and spacing rules. It mandates structured documentation, component state definitions (default, hover, error, etc.), and strict adherence to WCAG accessibility standards, ensuring consistency and usability across all digital products.

This guide details how to deploy and manage web projects on Vercel using token-based authentication via the CLI. It provides comprehensive steps for locating and setting the VERCEL_TOKEN, identifying project IDs, and executing deployment commands (including linking and direct deployment) without relying on interactive login.

A comprehensive skill for generating new design screens from text prompts or images, and iteratively editing existing designs. It incorporates advanced prompt enhancement, design tokens, and professional UI/UX terminology to ensure professional, structured, and context-aware design output for web and mobile platforms.

A comprehensive skill for establishing a single source of truth for design tokens within Stitch. This tool guides users through retrieving project assets, synthesizing design rules from existing screens or descriptions, creating/updating the central design system, and systematically applying these tokens across all project screens to ensure UI consistency.

A powerful DI extension point for Website Builders, allowing developers to inject custom query parameters into all live preview URLs. This is essential for integrating complex features like signed tokens, tenant identifiers, or feature flags directly into the preview experience. It supports asynchronous operations, such as fetching remote authorization tokens, ensuring robust customization across the editor iframe and generated links.

A dedicated tool for querying Lark Meeting Notes (Notes) details and raw verbatim transcripts. It requires an explicit note_id to function, allowing users to determine the display type, access associated document tokens, and retrieve the original unified transcript. It strictly focuses on note-based retrieval and does not handle searching by title, document body, or meeting ID.

This guide details the forensic process of extracting sensitive credentials, including password hashes, Kerberos tickets, and authentication tokens, from memory dumps. Utilizing industry-standard tools like Volatility and Mimikatz, this technique is crucial for incident response, determining the scope of a breach, and identifying compromised accounts during digital forensics investigations.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.

This guide outlines a comprehensive workflow for detecting and preventing the exposure of sensitive AWS credentials (access keys, session tokens) within source code repositories, CI/CD pipelines, and configuration files. It utilizes TruffleHog for deep historical scanning and integrates git-secrets for robust pre-commit hooks, significantly reducing the risk of credential theft and unauthorized account access.

ROADtools is a comprehensive offensive toolkit for Microsoft Entra ID (Azure AD). It consists of ROADrecon for offline directory enumeration (users, groups, roles, policies) and roadtx for advanced token acquisition and exchange. It is designed for authorized red-teaming and penetration testing to discover attack paths and pivot tokens across various Microsoft resources.

This skill simulates advanced red-teaming techniques targeting Microsoft Entra ID's OAuth 2.0 device-code flow and illicit consent mechanisms. It demonstrates how attackers can steal access and refresh tokens, bypass Multi-Factor Authentication (MFA), and pivot across various Microsoft 365 services. It is designed for authorized security testing to validate token protection and conditional access policies.

This toolkit provides comprehensive offensive and administrative capabilities for Microsoft Entra ID, Azure AD, and AD FS. It allows authorized penetration testers to perform unauthenticated reconnaissance, acquire various access tokens, and critically, test for federation backdoors (Golden SAML). It is essential for validating identity-attack resilience and producing detailed hardening recommendations during red-team engagements.