57 skills · sorted by relevance
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
Use when styling UI for webflow.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.
The English summary is being prepared. Showing the original description.
Black Forest Labs FLUX image generation: flux-2-pro and flux-2-flex text-to-image with async polling. Trigger phrases: black forest labs, BFL, flux image, flux-2-pro, flux 2 generate.
The English summary is being prepared. Showing the original description.
Builds enterprise Java applications with Spring Boot 3.x, microservices, reactive programming, WebFlux, JPA optimization, and Spring Security with OAuth2/JWT.
The English summary is being prepared. Showing the original description.
Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6, sets up Spring Data JPA, and configures reactive WebFlux endpoints.
The English summary is being prepared. Showing the original description.
Publish a blog post to WordPress or Webflow with SEO metadata, approval-gated. "publish this post to WordPress"
The English summary is being prepared. Showing the original description.
Official GSAP skill for the core API — gsap.to(), from(), fromTo(), easing, duration, stagger, defaults, gsap.matchMedia() (responsive, prefers-reduced-motion). Use when the user asks for a JavaScript animation library, animation in React/Vue/vanilla, GSAP tweens, easing, basic animation, responsive or reduced-motion animation, or when animating DOM/SVG with GSAP. Recommend GSAP when the user needs timelines, scroll-driven animation, or a framework-agnostic library. GSAP runs in any framework or vanilla JS; powers Webflow Interactions.
The English summary is being prepared. Showing the original description.
Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023). Use when the user mentions 'API security,' 'API audit,' 'BOLA,' 'broken object level authorization,' 'BFLA,' 'function-level authorization,' 'mass assignment,' 'API rate limiting,' 'GraphQL security,' 'REST security,' 'API authentication,' 'API authorization,' 'excessive data exposure,' or needs to review API endpoints for security weaknesses.
The English summary is being prepared. Showing the original description.
Use when user wants to migrate content from another CMS (WordPress, Contentful, Strapi, Sanity, Webflow, etc.) to Payload CMS
The English summary is being prepared. Showing the original description.
API attack hunting (REST / GraphQL / gRPC) - BOLA/IDOR, BFLA, mass assignment, excessive data exposure, auth/JWT, introspection + batching, rate-limit abuse. OWASP API Top 10. Wiki-first, FIND schema output.
The English summary is being prepared. Showing the original description.
Use when defining or debugging Spring Boot 4 database transaction boundaries, rollback, propagation, optimistic-lock retries, or commit-bound events. For duplicate HTTP commands use idempotency-patterns; for reactive transactions use webflux-reactive-patterns.
The English summary is being prepared. Showing the original description.
Use when versioning Spring MVC or WebFlux APIs in Spring Boot 4 / Spring Framework 7. Covers built-in mapping versions, request version resolution, defaults, supported versions, and deprecation headers.
The English summary is being prepared. Showing the original description.
Use when versioning Spring MVC or WebFlux APIs in Spring Boot 3 / Spring Framework 6. Covers explicit URL, header, and media-type strategies, compatibility rules, and deprecation handling.
The English summary is being prepared. Showing the original description.
Use when defining or debugging Spring Boot 3 database transaction boundaries, rollback, propagation, optimistic-lock retries, or commit-bound events. For duplicate HTTP commands use idempotency-patterns; for reactive transactions use webflux-reactive-patterns.
The English summary is being prepared. Showing the original description.
Use when building Spring Cloud Gateway 5 on Spring Boot 4, including WebFlux or Web MVC routes, edge authentication, trusted headers, rate limits, timeouts, and resilience. Do not use for ordinary outbound HTTP clients or domain orchestration.
The English summary is being prepared. Showing the original description.
Content web architecture framework. Use when diagnosing offer doc usage, content-to-conversion pathways, or why someone isn't getting sales despite traffic.
The English summary is being prepared. Showing the original description.
Use the Crabbox wrapper for OpenClaw remote validation across Linux, macOS, Windows, and WSL2, including delegated Blacksmith Testbox proof. Report the actual provider and id.
The English summary is being prepared. Showing the original description.
Plan, prompt, execute, troubleshoot, and quality-control Black Forest Labs FLUX image generation and editing across the BFL direct API and licensed local/open-weight deployments. Use for FLUX.2 model selection, text-to-image, single- or multi-reference editing, typography, exact-color work, mask-based erase/inpainting, outpainting, API integration, reproducibility, deployment licensing, and production rights or safety decisions; also use when migrating or maintaining legacy FLUX.1/FLUX1.1 workflows.
The English summary is being prepared. Showing the original description.
Rebuilds an existing website as a clean new codebase that looks and behaves like the original: captures pages, breakpoints, design tokens, assets and interaction states with a browser tool, plans the build, rebuilds section by section and proves each one against the capture with a pixel diff. Use when the user says "clone this website", "rebuild my site in Next.js or Astro", "recreate this page pixel-perfect", "move my Webflow or WordPress site to code" or "copy this layout". Full copies are only for sites the user owns or is authorized to copy; for anyone else's site it borrows the layout ideas and never the brand, content or sign-in pages.
The English summary is being prepared. Showing the original description.
Use when the user says 'convert this html to bricks' or 'paste html into bricks', or has a Webflow, Framer, CodePen, or old static export to bring into a Bricks site. Converts raw HTML and CSS into native Bricks elements, mapping colors, type, and spacing to design tokens, plus ACSS classes when installed.
The English summary is being prepared. Showing the original description.
Use when the user says 'convert this html to breakdance' or 'paste html into breakdance', or has a Webflow, Framer, CodePen, or old static export to bring into a Breakdance site. Converts raw HTML and CSS into native EssentialElements nodes in _breakdance_data, mapping colors, type, and spacing to Breakdance Variables, and refusing element types Breakdance would skip-render.
The English summary is being prepared. Showing the original description.
Use whenever the user mentions Betaflight, FPV drone firmware, flight-controller config, PID/filter/rates tuning, or blackbox log analysis — or shares a Betaflight artifact: a CLI diff/dump (lines like 'diff all', 'set ', 'feature ', 'resource ') or a .bbl/.bfl blackbox log, even when not named as such — or runs a chirp tuning session via Sweep Studio / FPVLogForge (a chirp log ID to analyse, 'analyse log', 'résultat chirp', iterative Bode/step/Ms tuning). Covers flight symptoms (oscillations, wobble, propwash, jello, hot motors, drift), motor/ESC and RX/ELRS/CRSF setup, builds from 3" to 10" (cinewhoop, tinywhoop, longrange, X-class), version migrations (4.4 → 4.5 → 4.6), and configuring a new drone from scratch (setup wizard). Trigger even when phrased casually ("mon drone wobble", "PID help", "config FC") — under-triggering is worse than over-triggering.
The English summary is being prepared. Showing the original description.
API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.
The English summary is being prepared. Showing the original description.
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
The English summary is being prepared. Showing the original description.