531 skills · sorted by relevance
Implement REST APIs in ABP Framework with AppServices, DTOs, pagination, filtering, and authorization. Use when building API endpoints for ABP applications.
The English summary is being prepared. Showing the original description.
ペネトレーションテストを対話的に実行するスキル。認可確認(Authorization Gate)→カテゴリ選択（Methodology, Reconnaissance, Scanning, VulnerabilityScanning, WebAppTesting, APITesting, PasswordAttacks, Exploitation, PrivilegeEscalation, ActiveDirectory, PostExploitation, WirelessAttacks, NetworkAttacks, SocialEngineering, CloudPentesting, MobileAppTesting, ContainerK8s, BinaryExploitation, OWASPTop10, Reporting, EmailSecurity, DatabaseAttacks, VPNRemoteAccess の全23カテゴリ）→ツール選択→コマンド実行→発見記録(Finding)→レポート生成をステップバイステップで進行。スコープ/除外チェック・ガードレール付き。「ペンテスト実行」「pentest」「侵入テスト」「脆弱性診断」「セキュリティテスト」「pentest executor」で発火。
The English summary is being prepared. Showing the original description.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
The English summary is being prepared. Showing the original description.
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
The English summary is being prepared. Showing the original description.
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
The English summary is being prepared. Showing the original description.
Apple アプリサービス。StoreKit 2 / CloudKit / WidgetKit / ActivityKit / User Notifications / Core Location / MapKit / HealthKit / Sign in with Apple。 Product, Transaction, RequestReviewAction, CKRecord, CKUserIdentity, Widget, TimelineProvider, UNUserNotificationCenter, CLLocationManager, CLServiceSession, Map, MKGeocodingRequest, HKHealthStore, ASAuthorizationController, AuthorizationController。
The English summary is being prepared. Showing the original description.
Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
The English summary is being prepared. Showing the original description.
Design or review a declared control-command profile and its verb/backend lifecycle matrix. Distinguish policy denial, unsupported capability, delivery acknowledgement, independently observed effect, and unknown outcome; bind authorization to principal, target, scope, current policy, expiry, and fencing epoch. NOT for claiming runtime correctness, proving an adapter from declarations, or approving a control-panel button without independent runtime evidence.
The English summary is being prepared. Showing the original description.
Build stateful Agents on Cloudflare Workers with current, source-verified SDK APIs. Covers durable state, RPC, chat, schedules, queues, fibers, Workflows, MCP, and channels while keeping authorization and external effects application-owned. NOT for assuming SDK helpers grant application authorization or effect approval.
The English summary is being prepared. Showing the original description.
Implement REST APIs in ABP Framework with AppServices, DTOs, pagination, filtering, and authorization. Use when building API endpoints for ABP applications.
The English summary is being prepared. Showing the original description.
Authentication and authorization patterns - JWT, OAuth2, sessions, RBAC, ABAC, passkeys, and MFA. Use for: authentication, authorization, jwt, oauth, oauth2, session, login, rbac, abac, passkey, mfa, totp, api key, token, auth, cookie, csrf, cors credentials, bearer token, refresh token, oidc.
The English summary is being prepared. Showing the original description.
Security hardening and best practices for .NET applications. Navigation skill covering OWASP Top 10, authentication, authorization, cryptography, secrets management, and secure coding. For building secure applications. Keywords: security, owasp, authentication, authorization, cryptography, jwt, oauth, secrets, hardening
The English summary is being prepared. Showing the original description.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
The English summary is being prepared. Showing the original description.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
The English summary is being prepared. Showing the original description.
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
The English summary is being prepared. Showing the original description.
Creates comprehensive permission tests ensuring RBAC doesn't regress with test matrices, CI gating, and authorization coverage. Use for "RBAC testing", "permission tests", "authorization testing", or "access control tests".
The English summary is being prepared. Showing the original description.
Operate the ClawSweeper maintenance bot for OpenClaw issues and pull requests, which are proposed code changes. Read findings, create repair jobs, monitor GitHub Actions, and manage automatic fixes or merges subject to authorization and validation checks.
Plan and verify security controls for AI agents that read untrusted content and use tools. Review permissions, file boundaries, network destinations, and credentials, then test that rejected actions leave no unintended changes.
Support product returns from eligibility checks and inspection to refunds and decisions about resale, repair, or disposal. The skill also provides frameworks for reviewing fraud indicators, handling warranty claims, and recovering costs from suppliers.
Implement and review security measures in Quarkus applications. Covers sign-in, access permissions, input validation, password hashing, secret storage, request limits, audit logs, and checks for known vulnerabilities in dependencies, with implementation and configuration examples.
Review Laravel authentication, permissions, database operations, forms, APIs, and production settings for security weaknesses. Use implementation examples to address unsafe input handling, exposed secrets, session risks, and insufficient access controls.
Build or review FastAPI applications using examples for project structure, input validation, authentication, permission checks, and asynchronous processing. Organize database updates in a separate business logic layer and test API behavior with httpx and pytest.
Prepare selected pull requests for maintainer review by comparing failures with their current base, fixing authorized defects, and preserving contributor credit. Report complete or partial validation with evidence and outstanding checks before any separately authorized merge.
Manage payment permissions for AI agents with spending caps, expiration dates, and merchant rules. Use cryptographic signatures to verify authorization, coordinate approval from multiple agents for high-value purchases, and track or revoke payment permissions.