Навыки: Безопасность

Trusted domains, security assessment patterns, and domain research standards for WebFetch permissions

Exploit insecure cross-window messaging (`window.postMessage`) — handlers that trust `event.data` without checking `even...

Bypass rate limits and anti-automation to enable brute force, OTP guessing, coupon abuse, and enumeration. Load when an...

Website vulnerability scanner and security audit toolkit. Scan any website for security issues: open ports (nmap), expos...

HTTP request smuggling (CL.TE/TE.CL/TE.TE/CL.0) — desync front-end and back-end to poison other users' requests. Load be...

Web Application Runtime Analysis

Attack SAML SSO — signature exclusion/wrapping (XSW), unsigned assertions, and comment/XXE tricks to forge authenticatio...

Fetch and extract visible text from a web page URL

Search the web using DuckDuckGo and return top results

Enforce web security and avoid security vulnerabilities

Exploits web application vulnerabilities. Use when working with SQL injection, XSS, SSRF, SSTI, command injection, path...

Aggregate SAST, SCA, DAST, secrets, API, frontend, and backend security checks into one report.

OWASP 十大漏洞原理、影响与修复方案，覆盖 Python/Java 场景

Security best-practices and hardening review for JavaScript/TypeScript web and Electron desktop applications. Use when a...

Top-level security code review for JavaScript/TypeScript web applications and Electron desktop applications. Use when th...

Use when testing web application security; Performing OWASP Top 10 assessment

Plan and run authorized, defensive security testing of web applications you own or have written permission to test (loca...

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaw...

Claim a dangling DNS record pointing to a deprovisioned service (subdomain takeover). Load after subdomain enum, on CNAM...

Register and authenticate against a WebAuthn/FIDO2 relying party using a self-built SOFTWARE authenticator (no hardware...

Attack WebSocket endpoints — CSWSH (cross-site hijacking), message tampering, and auth gaps. Load on ws:// or wss:// con...

Find and prove Cross-Site Scripting (reflected, stored, DOM). Load when input is echoed into HTML/JS/attributes, a searc...

XML External Entity injection → file read, SSRF, sometimes RCE. Load when the app parses XML you supply: SOAP, SAML, XML...

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL...

Expert en Web3 avancé (DeFi, DAOs, smart contracts, tokenomics, Layer 2, DZ regulations)

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, ora...

Guide for Web3 and blockchain security research including smart contract auditing, DeFi vulnerabilities, and blockchain...

condition: Rede blockchain congestionada ou indisponível

Implement and debug wallet connection and authentication in this repo using thirdweb v5 and the SIWE-style flow in `app/...

Web application security testing - OWASP Top 10, API security

| | **Broken Authentication** | OWASP API2:2023 - weaknesses in authentication mechanisms that allow attackers to assume...

Automated web application vulnerability scanner and exploit generator starting from domains or URLs. Tests for SQLi, XSS...

Web security assessment. USE WHEN web assessment, pentest, security testing, vulnerability scan. SkillSearch('webassessm...

Send an HTTP POST to any configured webhook endpoint

Build webhook signature verification for Paymob, Stripe, Resend, and generic HMAC. Triggers when user asks to verify web...

Secure webhook endpoints. Use when a user asks to verify webhook signatures, prevent replay attacks, handle webhook retr...

Use when designing a webhook delivery system, implementing HMAC signature verification on a receiver, handling retries a...

Webhook design patterns — delivery, retry with exponential backoff, HMAC signature verification, payload validation, ide...

Use when an application uses WebSockets (ws:// or wss://) on an authorized engagement. Covers finding WebSocket endpoint...

Securing the WebSocket upgrade and the frames after it: Origin validation against Cross-Site WebSocket Hijacking, authen...

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Receive and verify WeChat Pay (APIv3) webhook notifications. Use when setting up WeChat Pay webhook handlers, debugging...

Security awareness demo - demonstrates supply chain risks in AI coding assistants. See the full research: https://x.com/...

The recursive Wen Wang Gua (文王卦) / Yijing interpretive apparatus — the full traditional toolkit for casting and reading...

Ask WG Code Sentinel to review your code for security issues.

- Check and interpret data-breach exposure for an email, username, phone or name using Have I Been Pwned, the Pwned Pass...

Add WhatsApp as a chat channel for the agent, routing inbound WhatsApp messages into the chat engine and replies back ou...

/============================================================================/