Loading...
Loading...
Found 277 Skills
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php .jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.
Edit arbitrary supplied video, audio, images, screen recordings, and graphics into a polished deliverable. Use for cutting and restructuring footage, multi-track compositing, picture-in-picture, transitions, captions, sound work, color and framing changes, screen demos, presenter edits, social clips, and motion graphics made with FFmpeg, HTML, React, SVG, or Remotion. Includes source inspection, timeline design, reusable media tooling, transparent overlay generation, fast review artifacts, deterministic rendering, and technical validation.
Answer "how does this work / how is this structured / what does this change" with a drawn figure and a narration that follows it — a module map from the code's own imports, a walked request, a state machine, an algorithm step by step, the change map of a branch — produced with `vlmkit-anim`, checked against the facts it draws, and delivered as an SVG / GIF next to the prose. Use whenever the user asks to explain, walk through, show the structure of, or illustrate code, a repository, a flow, a protocol, a PR, or a bug, and a picture with four or more things and their relations would carry the answer better than a paragraph. The explanation is the deliverable; the picture is its evidence. Scene mechanics are in `explanatory-animation`.
Draws static SVG figures for lessons, READMEs and manuals in the AI Engineering from Scratch look: paper panel, blueprint accent, nine figure kinds, fixed hue meanings, eight arrow styles, and checks for legibility and markup. Trigger phrases: "draw a figure", "blueprint figure", "sequence figure", "state machine figure", "figure for this lesson", "add a diagram to the manual".
Animate React components with Animate UI (Motion-based animated primitives for Radix UI, Base UI and React Aria). For shadcn/ui components, runs the `@animate-ui/cli` codemod that swaps their primitives for Animate UI's; for components built directly on Radix UI, Base UI or React Aria, swaps the import to `@animate-ui/react`; for anything else (custom components, plain markup, other libraries), applies Animate UI's motion rules, tokens (springs, curves, scales, blur, shifts) and recipes with Motion (motion/react). Also reviews existing motion with the `audit` command, migrates Animate UI v1 projects, and turns any icon (Lucide, Hugeicons, Tabler, Phosphor, a custom SVG) into an animated icon compatible with `AnimateIcon`. Use when asked to animate a component, make shadcn/ui "animated", add enter/exit, press or swap animations, set up Animate UI, animate an icon, change the animation pace, review whether motion follows Animate UI's rules, or find slow and janky animations.
Build GSAP motion without restyling, as single effects or the full treatment: for "we're animaxxing", every element enters from a blank page, rests, and leaves. Text: split, scramble, glitch, typewriter, and speak-in entrances, scattering headlines, letter waves, text on a path, count-ups, odometers. Scroll: reveals, scrubbing, parallax, pinned scenes, stacking cards, zoom-through, horizontal runs, waypoints, smooth scroll, paging. Pointer: magnetic, tilt, spotlights, directional fills, press ripples, shakes, cursor followers, image trails, proximity, label rolls, underlines. Drag: throw tracks, endless loops, card stacks, sortable lists, swipe to dismiss. Also page covers, Flip and shared-element morphs, menus, dialogs, tabs, state buttons, media and SVG effects, marquees, CustomEase, sound, confetti, particles, and hover stuck on touch. Pair with the matching GSAP framework skill. Not for branding, redesign, routing, or GSAP API questions.
Build a slide deck whose source is text and whose figures are laid out by TALA — one Markdown file with a ```d2 fence per figure, compiled to a self-contained HTML deck (keyboard nav, overview grid, print-to-PDF), each figure as its own SVG, and a copy manifest. The deck is a page, so vlmkit's own gates read it: `check integrity` for a slide that breaks or clips, `check copy --manifest` for text the frame cut off, `check a11y contrast` for a projector. Loop: write `deck.md` → build → gates → fix. Use when asked for slides, a deck, a talk, a presentation, a review walkthrough, or a figure-heavy explainer that has to be presented rather than read. Not for one diagram (`d2-diagram`) or a moving figure (`explanatory-animation`).
Build a beautiful macOS-inspired documentation site (single HTML file) with a liquid-glass surface system (tiered glassmorphism: opacity ladder, blur scale, edge highlights), animated SVG diagrams, traffic-light window chrome, and a light-blue + white liquid-glass palette (white glass surfaces over a soft blue gradient field, per-section blue-tone theming). Also trigger on "liquid glass", "frosted glass", or "translucent UI" requests for docs/showcase pages. Trigger when the user wants to create a docs site, landing page, showcase, portfolio, guide, tutorial site, feature overview, or product documentation — especially when they mention wanting it to look "clean", "modern", "Apple-like", "macOS style", "glass", "frosted", "animated diagrams", or "single HTML file". Also use when the user has multiple markdown files and wants them rendered into a cohesive visual HTML page with sections. If the user says "6 file" or wants separate pages per topic, generate one HTML file per wiki file (index.html as overview + N topic files), NOT a single combined page.
Removes the tells that make prose, user interfaces, and graphics read as AI-generated, then reports what changed. Rewrites performative phrasing, contrast framing, triads, signposting, emdashes, and marketing filler in prose; strips purple gradients, glassmorphism, pulsing badges, eyebrow labels, pill-everything, emoji decoration, and landing-page treatment of functional screens from UI code; and cleans decorative blobs, misaligned SVGs, broken ASCII art, and rainbow palettes from graphics and diagrams. Use when the user says /ai-sanitize, asks to "remove AI tells", "de-slop", "make this sound less like AI", "make this UI look less AI-generated", "humanize this copy", or asks why a page or draft feels generated. Edits in place by default; pass "report" to list tells without editing.
XMindify Mind Map Generator, supports scenario-based templates and automatic generation. It is used to create XMindMark files and convert them to XMind/SVG formats. Trigger scenarios: (1) User requests to create a mind map (2) User needs to analyze papers/summarize content/brainstorm (3) User mentions terms like "mind map", "brain map", "structured" etc.
Create a beautiful HTML explanation of a repo, spec, PR, architecture, or concept so a smart beginner can understand and retell it.