Loading...
Loading...
Found 867 Skills
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification, subscription abuse, multipart upload GraphQL, schema enumeration, __schema, __type.
Review and compare UX designs, flows, prototypes, specifications, or implementations against user goals, evidence, interaction behavior, accessibility, design-system fit, content, and engineering intent. Use when a designer asks for critique, comparison, tough feedback, review before approval, or wants to check whether implementation preserved the intended experience.
Guide for working through a Jira story efficiently by separating context gathering, immutable evidence collection, codebase exploration, human-in-the-loop specification refinement, execution planning, and implementation. Use when turning a ticket into a reliable engineering workflow instead of jumping straight to code.
Evaluate project specifications at inception (Step One), deterministically assess Scale & Load, Domain Decoupling, and Resource Intensity vectors, and automatically enforce a distributed Microservices Architecture when warranted, preventing monolith scaffolding.
Generates Tzatziki-based Cucumber tests (Gherkin .feature files) from a functional specification. Use this skill whenever a user wants to write Cucumber tests, add BDD scenarios, create feature files, generate tests, or test application behaviors with Gherkin — especially in Java/Spring projects. Use this skill for tests involving HTTP, relational database (SQL), JPA, Kafka, MongoDB, OpenSearch, logging, or MCP. Also use when the user mentions writing integration tests, acceptance tests, or end-to-end tests.
Analyses a third-party system's API or file specification against Factorial's integrations framework and produces a detailed integration mapping document — the integration domain (payroll or finance), every capability in that domain with its verdict (fully, partially or not supported), the vendor endpoints to use for each, and the field-by-field mapping between Factorial's API and the vendor's. Use whenever someone shares a vendor API spec, OpenAPI/Swagger file, developer-portal link, integration guide or file layout and wants to know what we could build against it, how to map it, whether an integration is feasible, or asks for integration scoping, a fit-gap assessment or a field mapping. Use it even for informal asks ("can we integrate with this?", "how would new hires map to their API?") and partial specs.
This skill should be used when the user asks to "infer schemas", "generate schemas from examples", "add schemas", "bootstrap schemas", or mentions inferring, generating, or adding schemas to OpenAPI/OAS specifications that have examples but missing schema definitions.
Gate 2 sub-skill - validates uncertain mappings from Gate 1 and confirms all field specifications through testing.
Conduct deep research using NotebookLM integration — upload documents, query with citation-backed answers, synthesize findings, and produce infographic-style presentations. Output in Markdown, HTML/reveal.js slides, or Mermaid diagrams with visual hierarchy design specifications.
Spec Status - displays pipeline progress dashboard for a single specification showing document statuses, blockers, and next action.
United Arab Emirates architectural code and regulatory reference. Covers the federal regulatory framework (UAE Fire and Life Safety Code of Practice 2018 by General Civil Defence, Federal Law 29/2006 + 2/2014 + 1/2020 for People of Determination, ESMA standards) plus the seven Emirates' independent codes: Dubai Building Code 2021 (DBC), Dubai Civil Defence regulations, Trakhees regulations for free zones, Dubai Green Building Regulations & Specifications 2011 + Al Sa'fat 2016, Dubai Universal Design Code 2017; Abu Dhabi International Building Code 2013 (ADIBC, IBC-derived), Estidama Pearl Building Rating System 2010, DMA Accessibility Code; Sharjah Department of Planning and Survey rules; northern emirates' deferral patterns to Abu Dhabi or Dubai codes. Includes climate zone hot-arid design overlays, sandstorm/ thermal expansion loads, ADM/DM approval workflows, RERA Dubai project registration, developer-master-developer-end-customer hierarchies (Emaar, Aldar, Nakheel masterplan compliance), DEWA/ADDC utility coordination, and the cross-walk between IBC, ASCE 7, NFPA, and UAE national amendments. Practitioner-grade clause-level reference for design teams working in any of the seven Emirates.
Use this skill to shape product or engineering work before committing time to it: set appetites instead of estimates, narrow raw ideas into bounded problems, sketch solutions at the right level of abstraction, de-risk rabbit holes, write pitches, bet with capped downside (circuit breaker), and govern builds with discovered scopes and scope hammering. Adapted from Basecamp's Shape Up and extended for human+AI-agent teams. Use when a raw idea, feature request, or "redesign X" grab-bag needs to become a bounded project before anyone builds; when planning how much work an idea is worth; or when delegated agent builds need budgets, kill criteria, and non-convergence rules. Do not use for discovering whether a problem is real (use product-discovery), for portfolio-level sequencing across quarters (product-roadmapping-and-portfolio), for formal specification after the bet is placed (spec-driven-development), or for task-level prioritization frameworks like RICE (product-methodology).