393 skills · sorted by relevance
Helps write and review Nginx configurations for websites and APIs. Covers forwarding requests to application servers, distributing traffic, HTTPS settings, caching, compression, and logs to support performance tuning and investigation of slow responses.
Uses a completed ZKsync Era investigation with no reportable findings as a defense study. It explains 25 tested attack vectors, the safeguards that blocked them, and criteria for deciding whether to continue reviewing a large bridge protocol.
Provides a reference for reviewing DeFi smart contracts, programs that manage blockchain transactions. It organizes vulnerability types with causes, code examples, search patterns, and fixes to help investigate accounting, permissions, boundary conditions, and pricing logic.
Install, upgrade, and remove the ingress-nginx-based KubeSphere Gateway extension, which manages external access to applications. Inspect gateways across cluster, workspace, and project scopes, and investigate stalled operations, Helm installation failures, or pod problems.
Use shared organization credentials to call search services, paid APIs, or Git remotes through a broker, an intermediary that adds authentication without revealing the secret. Requests stay within the configured hosts, paths, and permitted operations.
Manage Superset plugins from installation and updates to account connections and removal. Check which external tools each plugin provides, call them through Superset, and investigate missing connections or other reasons tools are unavailable.
Build TypeScript services that fetch API data for display panels. Use a circuit breaker, which pauses calls after repeated failures, alongside caching and default values, while keeping API keys on the server through proxy endpoints.
Set up a personal monitoring dashboard with Vite and TypeScript. The skill provides a folder layout, dependency and build settings, and a page entry point for organizing stock and news panels, data services, and shared utilities.
Build TypeScript data services that separate API calls from display components. Add caching and a circuit breaker, which pauses calls after repeated failures, while keeping user-triggered requests able to report errors directly.
Connect stock data to an application using Finnhub Stock API. The skill covers current quotes, company profiles, historical prices, and market news, with server-side request handling to protect API keys and manage cached responses.
Build TypeScript data services with optional query filters, typed results, and caching. Add a circuit breaker, a mechanism that pauses API calls after repeated failures, and keep API keys behind server-side proxy endpoints.
Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.
Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.
Assess how Wi-Fi clients respond to impersonated access points using Evil Twin, KARMA, and Mana methods. Covers portal-based credential exposure, traffic interception conditions, client behavior, and limits imposed by modern protections.
Organize authorized phishing exercises from sending infrastructure and email scenarios to landing pages and reporting. Uses GoPhish campaign tracking to review opens, clicks, and submissions while assessing employee awareness and email security controls.
Create server endpoints in Expo Router and deploy them with EAS Hosting. Use them to keep API keys off the client, validate incoming data, access databases, proxy external services, and receive webhook notifications.
Configure external APIs and existing MCP tool servers through Higress AI Gateway. The skill covers YAML-based setup, credential updates, Worker access permissions, and connection checks before making tools available to the Workers that need them.
Review DeFi smart contracts using ten vulnerability classes, related-function comparisons, and code search patterns. Includes target selection criteria and a Foundry test template for building reproducible proofs of security issues.
Review DeFi smart contracts for ten classes of security flaws, including inconsistent accounting, missing permissions, and price manipulation. The skill helps prioritize audit targets and build Foundry tests that reproduce a finding and demonstrate its impact.
Investigate SQL injection in search forms, filters, and APIs by choosing tests based on actual responses. The skill covers visible query results, response differences, and timing evidence, helping produce reproducible reports with concrete data impact.
Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.
Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.
Assess Kubernetes and Docker security across exposed APIs, access permissions, service account tokens, and container boundaries. Use actual data reads or command output to establish impact and distinguish information exposure from broader compromise.
Configure XRequest for API calls and streaming responses, where data arrives in successive pieces. This skill covers request settings, authentication, debugging, and environment-specific handling of credentials for standalone requests or integration with chat providers.