Skill UI

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

This comprehensive guide details essential security best practices for integrating with Customer.io. It covers secure credential storage using secrets managers, sanitizing Personally Identifiable Information (PII) via hashing, verifying webhook signatures (HMAC-SHA256) to ensure data integrity, and establishing procedures for API key rotation to maintain compliance with GDPR/CCPA regulations.

A robust solution for implementing and handling real-time webhooks from Customer.io. This tool processes critical marketing events, including delivery status, opens, clicks, bounces, and unsubscribes. Key features include HMAC signature verification for security, reliable asynchronous event processing, and structured routing to manage various customer interactions, allowing data to be streamed efficiently to a data warehouse or CRM.

A comprehensive guide detailing essential security best practices for integrating with Documenso document signing. Covers critical topics such as secure API key management (using environment variables), robust webhook secret verification (preventing timing attacks), implementing least privilege document access control, and setting up secure self-hosted signing certificates and secrets.

A comprehensive expert resource for building high-performance, async-first APIs using FastAPI, SQLAlchemy 2.0, and Pydantic V2. Covers advanced topics like microservices architecture, WebSockets, advanced security (OAuth2, RBAC), robust testing strategies (pytest), performance optimization, and modern DevOps practices (Docker, Kubernetes). Ideal for mastering scalable, production-ready Python web services.

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Performs authorized file path traversal assessments to map web inputs, craft traversal payloads, and document sensitive files that can be read, aiding defenders in hardening filesystem handling during security reviews.

This guide outlines essential security best practices for integrating Firecrawl. It covers secure API key storage (using environment variables and .gitignore), verifying webhook signatures with HMAC-SHA256 for data integrity, implementing key rotation strategies across different environments (dev/staging/prod), and sanitizing scraped content to mitigate XSS and PII risks. Essential for building secure, production-grade systems.

This guide outlines essential security protocols for integrating Fireflies.ai. It covers best practices for managing sensitive API keys (e.g., environment variables, pre-commit hooks), implementing robust HMAC-SHA256 webhook signature verification in multiple languages (TypeScript, Python), and correctly configuring transcript privacy levels to ensure data confidentiality. Ideal for developers setting up production-ready integrations.

An expert skill dedicated to building secure, robust frontend applications. It specializes in preventing client-side vulnerabilities such as XSS and clickjacking. Core capabilities include safe DOM manipulation, implementing Content Security Policy (CSP), advanced input sanitization (allowlisting), and securing complex interactions like secure redirects and session management.

This skill guides the development of robust, security-focused full-stack web applications. It ensures layered security coverage across the entire application stack, from database queries (parameterized queries) to API endpoints (authentication/authorization) and frontend components (input validation, output encoding). Use this when building end-to-end features, microservices, or REST APIs that require simultaneous attention to Frontend, Backend, and Security best practices.

Map web inputs for reflected or stored HTML injection, send crafted tags via URLs, POST bodies, or visible fields, and document appearance/phishing manipulations for authorized security assessments.