Skill UI

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

This comprehensive checklist details advanced methods for bypassing Web Application Firewalls (WAFs) during security assessments. Techniques covered include encoding bypass (URL, Unicode, double encoding), HTTP header manipulation, IP rotation, payload obfuscation, and fingerprinting specific WAF vendors (e.g., Cloudflare, Akamai). It is essential for penetration testers evaluating the robustness of web defenses.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This comprehensive checklist details how to test for XML External Entity (XXE) injection vulnerabilities. It covers classic, blind, error-based, and out-of-band techniques, enabling testers to identify weaknesses in XML parsers. The methodology includes finding various injection points (e.g., file uploads, SOAP/REST endpoints) and exploiting potential risks like file disclosure, SSRF, and DoS. Use this guide for robust web application security testing and bug bounty hunting.

This skill provides a structured guide for setting up CI/CD pipelines to test Persona identity verification integrations. It demonstrates how to use sandbox API credentials, simulate webhooks, and run comprehensive integration tests. It is essential for developers ensuring the reliability and security of KYC/identity services before deployment.

This guide details best practices for securing Persona identity verification implementations. It covers critical security measures such as API key rotation, webhook HMAC verification, encrypting Personally Identifiable Information (PII) at rest, and maintaining comprehensive audit logs. Use this when integrating Persona into a production system requiring high data security and compliance.

This guide demonstrates how to set up a secure and robust webhook endpoint to process identity verification events from Persona. It covers essential security practices, including HMAC signature verification using TypeScript and Express, handling critical KYC lifecycle events (like inquiry approval/declination), and implementing idempotent processing to prevent data duplication. Ideal for integrating third-party identity services into a web application.

This guide provides implementation patterns for establishing security basics when working with QuickNode. It details how to utilize blockchain RPC endpoints and the QuickNode SDK for robust Web3 infrastructure integration. Learn best practices for secure connection, understanding error handling (like 401 Unauthorized or rate limiting), and building reliable applications on the Ethereum network.

This comprehensive guide outlines best practices for securing SalesLoft API access and integrations. It details secure token lifecycle management (OAuth refresh), implementing robust webhook signature verification using HMAC-SHA256 to prevent replay attacks, and enforcing scope minimization for least-privilege access. Use this when designing production-grade, secure enterprise integrations.

Automates the entire process of web research and professional communication. It takes raw web search results and formats them into polished, structured messages, digests, or threaded summaries optimized for Slack. Users can generate outputs in Slack's native Markdown format, Block Kit JSON, or a ready-to-use Webhook command, perfect for weekly reports, security alerts, and competitive intelligence updates.

Implement comprehensive automated policy enforcement for Shopify apps, ensuring security and adherence to App Store guidelines. This skill includes ESLint rules for detecting hardcoded API secrets, enforcing GraphQL query cost budgets, and running pre-commit hooks and CI checks for critical compliance validations (e.g., GDPR webhooks). Use it when hardening a production-ready Shopify application.

A comprehensive checklist for deploying Shopify apps to production or submitting to the App Store. It covers critical areas including API versioning, mandatory GDPR compliance webhooks, webhook security best practices, rate limit resilience, and App Store listing requirements. Use this guide when preparing for a major launch or auditing existing compliance gaps to ensure maximum stability and security.