Loading...
Loading...
Found 228 Skills
Turso Cloud — fully managed SQLite-compatible database platform, accessed over the network. Use when connecting an application to a Turso Cloud database, creating or scoping auth tokens (JWT, fine-grained permissions, JWKS/external auth providers), or provisioning and managing cloud databases. Covers per-language SDKs (JavaScript/TypeScript, Python, Go, Rust), authentication & authorization, and marketplace integrations (Vercel).
Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators.
Configures Google Cloud API Gateway to act as a remote Model Context Protocol (MCP) server (Public Preview) that exposes REST APIs as agent tools over HTTP (POST /mcp). Use when migrating OpenAPI 2.0 specs to OpenAPI 3.x for MCP, annotating specs with x-google-api-management.mcp and x-google-mcp-tool, securing tools/list with JWTs or API keys, connecting Google ADK (McpToolset) or Apigee API hub and Agent Registry, or troubleshooting MCP JSON-RPC errors (-32601, -32602, -32000). Do not use for Apigee X proxy bundles, outbound LLM model routing, or GKE Gateway API.
Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.
Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak hashes, insecure encryption modes, unsafe randomness, bad KDF/password hashing, JWT signing mistakes, disabled TLS verification, and dangerous serialization. Runs a dependency-free offline scanner for high-recall findings, then the model confirms impact and writes concrete fixes with redacted evidence. Use when reviewing app code that handles encryption, tokens, sessions, certificates, or credentials; when asked to scan for hardcoded secrets, exposed API keys, weak crypto, AES-ECB/CBC misuse, MD5/SHA1 password hashing, insecure random tokens, verify=False, InsecureSkipVerify, rejectUnauthorized false, alg none JWTs, or committed private keys. Not for Terraform/Kubernetes-only audits (use infra-security), package install-hook risk (use supply-chain-security), or vetting an agent skill before install (use skill-security).
Sa-Token microservice authentication skill. Covers the Same-Token mechanism for isolating internal services from the public network, centralized authentication through SpringCloud Gateway (Reactor reactive), authentication for internal RPC calls via Feign/Dubbo/gRPC, distributed session solutions (Redis Session center/JWT stateless), Reactor/WebFlux framework integration, and SpringBoot 3/4 dependency compatibility. Use this skill when users need inter-service authentication in a microservice architecture, gateway Token forwarding and validation, isolation of internal services from the public network, or distributed session sharing. For basic login authentication, use the `sa-token` skill first.
Protect a portfolio slice by applying one Universal (canonical) policy across API instances on any gateway (Kong, Apigee, Azure, AWS, MuleSoft). Use when the user says all / many / my APIs / a portfolio slice — JWT validation, rate limiting, spike arrest, IP filtering, or apply one config across providers. DO NOT TRIGGER for "what protection do I have" / listing or editing already- applied native policies — use skill apply-native-policy-to-instance. DO NOT TRIGGER for a single already-chosen instance that needs a provider-native plugin — same skill. Do not use to remove, detach, enable, or disable a policy (those tools do not exist).
zkLogin on Sui — architecture, protocol flow, integration, and security. Use when explaining how zkLogin works, integrating zkLogin into a Sui application, choosing an OpenID provider, understanding the address derivation scheme, debugging session lifetime or proof issues, or answering questions about zkLogin security properties (salt, ephemeral keys, JWT privacy). Also use when the user asks about OAuth-based wallet-less login on Sui.
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
Core skill for Sa-Token, a lightweight Java authentication and authorization framework. It covers login authentication, permission/role authentication, annotation-based authorization, route-interceptor authorization, Session management, forced logout, Token expiration strategies, framework configuration, Token styles and submission prefixes, frontend-backend separation, remember-me mode, mutually exclusive login on the same device, and handling NotLoginException scene values. StpUtil is the core facade utility class and provides a complete suite of authentication APIs, including login/checkLogin/logout/isLogin/getLoginId/getTokenValue. Use this skill when users need to integrate permission authentication into Java Web projects, use StpUtil for login and permission validation, configure route interceptors, or implement annotation-based authorization. It does not cover advanced features such as secondary authentication, account banning, multi-account support, SSO, OAuth2, microservices, API security, JWT, or Redis; use the corresponding specialized skills for those.
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).