Your agent can do more. Find the skill that makes it happen.
Find your next superpower If you are an agent, refer to our llms.txt for full access.Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repe…
Provides a systematic approach to reviewing, proofreading, and polishing marketing copy. Uses multiple focused editing passes to improve existing text.
Converts COBOL copybooks into C# types and metadata. Supports typed contracts, source generation, and fixed-width serialization.
Supports writing and rewriting copy for homepages, landing pages, pricing, feature, product, and about pages. Emphasizes clear, compelling, testable copy aligned with honesty and conversion best practices.
Creates, rewrites, and refines copy for homepages, pricing pages, feature pages, about pages, and product pages. Supports marketing headlines and CTA wording.
Covers core component library usage and design system patterns. Supports building UI and working with design tokens and reusable components.
Covers CoreEx validator variants with or without constructor injection and FluentValidation-style AbstractValidator classes. Supports adding rules and validating nested entities, collections, and dictionaries within the application layer.
CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the Origin header in Access-Control-Allow-Origin or set it to with Access-Control-Allow-Credentials: true. Detect via Origin: https://attacker.com reflection in Access-Control-Allow-Origin response header, wildcard on credentialed endpoints, and null origin acceptan…
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
Guides Cosmosh renderer UI design, implementation, refactoring, and review. Covers pages, layouts, tabs, SSH terminal and SFTP interactions, settings, visual tokens, styles, Radix wrappers, localization, and UI/UX documentation.
Performs a read-only review of an existing Coval evaluation setup, including judge validation and misleading scores. Helps assess inherited evaluations and whether results support a release decision.
Write the context brief a first-time tester gets before testing an app, tool, codebase, or product — it explains WHAT the thing is and why it exists, while deliberately withholding HOW anything works. The companion to the fresh-eyes skill; the brief it produces is the "starting information" handed to a fresh-eyes tester. Use this whenever the user is preparing a fresh-eyes or first-time-user test …
Skills give your agent reusable instructions for a specific job. Pick one, read what it does, and bring it into your workflow.
A name only tells half the story. Search the full description and instructions to find the right fit.
Read the skill, visit its source, and see exactly what you’re adding to your agent.
Copy the install command from a skill page and run it in your project.
npx skillycli add owner/repo --skill name