Loading...
Loading...
Found 33 Skills
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
Perform black-box / grey-box web application penetration testing on an authorized target — auth bypass, IDOR, session handling, business-logic flaws, parameter tampering, Burp Suite / OWASP ZAP workflows. Use when the user mentions 'web pentest,' 'web application penetration test,' 'pentesting,' 'bug bounty,' 'Burp Suite,' 'ZAP,' 'OWASP testing,' 'authentication testing,' 'session testing,' 'authorization testing,' 'business logic testing,' 'web vulnerability testing,' or has explicit authorization to test a live web application.
Parallel 3-reviewer code review orchestration: launch Security, Business-Logic, and Architecture reviewers simultaneously, aggregate findings by severity, and produce a unified BLOCK/FIX/APPROVE verdict. Use when reviewing PRs with 5+ files, security-sensitive changes, new features needing broad coverage, or when user requests "parallel review", "comprehensive review", or "full review". Do NOT use for single-file fixes, documentation-only changes, or when systematic-code-review (sequential) is sufficient.
Turn a settled business-logic spec (from `feature-discovery` or a freshly-described feature in chat) into a detailed, code-grounded implementation plan saved as `docs/<feature-slug>-plan.md`, ready for `plan-task-breakdown` to convert into checkboxes. Verifies feasibility against the actual codebase, names the specific files/types/actions/components to touch, identifies test cases at every layer that fits (unit, integration, and — for user-visible flows — a Playwright happy-path e2e test), and asks the user clarifying questions for implementation-level ambiguities only — never re-litigates business logic. Use this skill whenever a feature's *what* is clear and the next move is mapping it to *how*. Trigger on phrases like "make a plan", "write the implementation plan", "plan this out", "design the build", "turn this spec into a plan", "how would we implement this", "scope out how to build X", "draft a plan for <feature>", or whenever the conversation just produced a business spec and the natural next step is implementation design — even if the user doesn't say "implementation plan" explicitly.
OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.
Define server-side JavaScript functions for Steedos objects using YAML. Functions are callable via REST API or from buttons/triggers. Covers function definition (.function.yml files in main/default/functions/), inline script with ctx/objects/global context, REST API exposure, calling from amis_button schemas, and examples for CRUD operations, data processing, and external API integration.
Use when implementing features with test-driven development, writing tests before code, building domain-rich business logic, or following hexagonal architecture
Implement, validate, and test JSONLogic rules for portable business logic. Use when working with JSONLogic syntax, creating rules for conditional logic, validating rule structures, testing rules against data, or converting business requirements to JSONLogic. Triggers on requests to "write jsonlogic", "validate jsonlogic", "create a rule", "business logic as JSON", "conditional logic", or any mention of JSONLogic rules.
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. It can be used for ANY security testing, auditing, or code review of web apps, APIs, or business systems, even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, penetration testing, security audit, vulnerability mining, payment security, privilege escalation, logic vulnerability, business security, SRC, code audit. It also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "help me test this interface", "can this parameter be modified", "help me find bugs".
Implement Subframe designs with business logic. Use after designing with /subframe:design or when given a Subframe URL/page ID.
Apply this when developing new features that add to or change the business logic of the system
Design and implement service layer classes for Frappe Framework v15 with proper business logic separation. Triggers: "create service", "add service layer", "frappe service", "business logic", "/frappe-service". Generates service classes with validation, orchestration, and integration patterns.