523 skills · sorted by relevance
Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
The English summary is being prepared. Showing the original description.
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
The English summary is being prepared. Showing the original description.
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
The English summary is being prepared. Showing the original description.
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
Test whether API users can read or change fields beyond their permissions. Examine responses for sensitive data, inject extra request fields to check unauthorized updates, and use explicit lists of allowed fields to guide fixes.
Compare local case files with insurer policies to prepare a concise prior authorization packet, covering approval requirements, referrals, missing information, and a checklist for staff reviewing the case and communicating with the patient.
Implements HIPAA Privacy Rule requirements for research uses of protected health information under 45 CFR §164.512(i). Covers IRB and Privacy Board waivers of authorization, individual authorization for research, limited data set and data use agreements, preparatory to research provisions, and decedent research provisions. Keywords: HIPAA research, IRB waiver, Privacy Board, authorization, limited data set, preparatory research, de-identification, Common Rule.
The English summary is being prepared. Showing the original description.
Implements permission-based authorization with custom attributes, policy providers, and authorization handlers. Provides granular access control beyond simple role-based authorization.
The English summary is being prepared. Showing the original description.
Implement iOS authentication patterns including Sign in with Apple (ASAuthorizationAppleIDProvider, ASAuthorizationController, ASAuthorizationAppleIDCredential), credential state checking, identity token validation, ASWebAuthenticationSession for OAuth and third-party auth flows, ASAuthorizationPasswordProvider for AutoFill credential suggestions, and biometric authentication with LAContext. Use when implementing Sign in with Apple, handling Apple ID credentials, building OAuth login flows, integrating Password AutoFill, checking credential revocation state, or validating identity tokens server-side.
The English summary is being prepared. Showing the original description.
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypas...
The English summary is being prepared. Showing the original description.
Add authorization methods for a new entity to AuthorizationService. Use after creating a resource service. Triggers on "add permissions", "authorization methods", "entity permissions", "add auth methods".
The English summary is being prepared. Showing the original description.
Implements permission-based authorization with custom attributes, policy providers, and authorization handlers. Provides granular access control beyond simple role-based authorization.
The English summary is being prepared. Showing the original description.
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.
The English summary is being prepared. Showing the original description.
Connect a remote Hermes gateway to MCP servers that require OAuth, a browser-based authorization process. The skill covers dashboard access, manual token setup when needed, and diagnosis of expired tokens or revoked sessions.
Prepare a selected batch of pull requests, or proposed code changes, by reviewing overlaps, diagnosing conflicts, and preserving contributor credit. Check the exact version and required authorization before each merge, then report completed work and remaining holds.
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.
Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.
Plan and configure security across Google Kubernetes Engine clusters. Review access permissions, enable Secret Manager integration, and configure protections such as Shielded Nodes and Binary Authorization to strengthen the platform supporting your applications.
Design authentication and access permissions for web apps, mobile apps, and backend services using OAuth 2.0 and OpenID Connect. Get guidance on authorization flows, token validation, secure storage, renewal, and revocation.
Set up and authenticate lark-cli, choose between user and bot identities, and resolve missing permissions. The skill also guides authorization links, JSON result checks, update notices, and confirmation steps for high-risk operations.
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
The English summary is being prepared. Showing the original description.
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
The English summary is being prepared. Showing the original description.