Skill UI

This skill acts as a comprehensive security scanner specializing in detecting Cross-Site Scripting (XSS) vulnerabilities in client-side code. It performs static analysis across React, Vue, Angular, and vanilla JavaScript, specifically identifying unsafe practices like direct HTML manipulation (innerHTML), raw rendering (v-html), and insecure URL handling. Use it when auditing frontend code for security flaws and needing best practices for secure coding.

Automated fuzz testing of APIs via the /fuzz-api command to inject malformed, boundary, and random payloads, spotting crashes, SQL injection, XSS, and validation gaps during vulnerability scanning or security reviews.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Automates web application penetration testing by leveraging the penetration-tester plugin to scan OWASP Top 10 threats, suggest exploitation techniques, and produce actionable vulnerability reports for pentest or vulnerability assessment requests.

Automates vulnerability scans for applications and APIs via the security-test-scanner plugin, covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, and authorization weaknesses while generating detailed remediation reports.

Centralizes proven red team methodologies into an automated reconnaissance and vulnerability discovery workflow that sequences asset discovery, live host validation, fingerprinting, content hunting, and exploit surface analysis for bug bounty and defensive assessments.

This skill provides a comprehensive, expert guide to the entire reverse engineering lifecycle. It covers advanced techniques for binary analysis, including static analysis (disassembly, metadata extraction, control flow mapping) and dynamic analysis (API hooking, memory tracing). Mastery includes utilizing industry-leading tools such as IDA Pro, Ghidra, radare2, and specialized frameworks like pwntools and angr. The methodology is structured for secure research, CTF challenges, and vulnerability assessment, emphasizing best practices and ethical use.

Automatically runs the vulnerability-scanner plugin to inspect code, dependencies, and configurations, detecting CVEs and insecure settings before releases and delivering detailed reports with remediation guidance.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Guide to mastering essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless checks, and compliance reporting, covering selection, configuration, and practical workflows.

Secret Scanner Assistant auto-activates within Security Fundamentals to guide you on secret detection, authentication, validation, secure coding, and vulnerability checks with best practices.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.