12,276 skills found · Page 259 of 410
onvoyage-ai / geo-content-planningReads existing brand DNA, keywords.csv, and prompts.csv, then produces a plan.csv — a strictly-schema'd content architecture telling the next pipeline step which pages to create, for which keyword/prompt clusters, and in what build order.
onvoyage-ai / reddit-opportunity-researchResearches Reddit using a brand's Brand DNA to find promotable pain-point discussions, target subreddits, and real user search language. Produces a prioritized Reddit opportunity list for content seeding, helpful replies, and prompt research inspiration.
onvoyage-ai / research-brandResearches a company from its URL and produces a Brand DNA file covering positioning, audience, competitors, voice, and messaging
Spielewoy / autopromptRun explicitly requested Autoprompt v2 work through the private controller. Ordinary coding and review requests do not activate this skill.
Spielewoy / autopromptRun explicitly requested Autoprompt work with task routing, owned assignments, independent checks, and bounded recovery.
boyang-hu / website-rebuild1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites). Evidence-driven pipeline - mirror-first forensics, line-number-traceable reverse engineering of minified bundles, verbatim porting, quantitative verification gates
uphiago / hunt-api-misconfigHunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies.
uphiago / hunt-brute-forceHunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA, IP-based rate-limit bypass via X-Forwarded…
uphiago / hunt-firebaseHunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase Hosting detection, GCP service account JSO…
uphiago / hunt-llm-aiHunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).
uphiago / hunt-supabaseHunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-t…
uphiago / wp-plugin-rest-auth-bypassScan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage.
uphiago / deep-invadeDeep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
uphiago / firebase-supabase-attackExploit Firebase/Supabase for data via JS config leak probe.
uphiago / xmlrpc-exploitationExploit XMLRPC multicall, pingback for brute force and SSRF.
uphiago / cors-chain-automationUse when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.
uphiago / recon-playbookUse when starting or restructuring an authorized external web and API assessment.
uphiago / api-noauth-huntUse when an API may expose data or privileged operations without authentication.
uphiago / asn-infrastructure-mappingMap organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.
uphiago / cache-attackPoison CDN cache or deceive when X-Cache header is detected.
uphiago / cms-detectionIdentify CMS, frameworks, and server technology stacks on live hosts.
uphiago / exchange-owa-attackExchange/OWA NTLM AD leak, spray attack when mail subdomain.
uphiago / flask-werkzeug-attackExploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
uphiago / github-secret-huntingFind leaked API keys, tokens, and credentials in public GitHub repositories.
uphiago / hardcoded-credential-huntDetect hardcoded passwords in HTML forms, JavaScript, and API responses.
uphiago / http2-header-impersonationSpoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.
uphiago / humanize-automationHuman-like mouse, keyboard and scroll behavior for behavioral bot bypass.
uphiago / js-secrets-extractionAnalyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
uphiago / origin-ip-discoveryDiscover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
uphiago / port-service-discoveryNmap scan for MySQL, Redis, FTP, SSH, internal API services.
