Integrations & APIs

uphiago Skill

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

uphiago Skill

Use when starting or restructuring an authorized external web and API assessment.

uphiago Skill

Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).

uphiago Skill

Use when an API may expose data or privileged operations without authentication.

uphiago Skill

Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.

uphiago Skill

Hunt read-protected write-gaping endpoints. PATCH/POST/DELETE without authorization while GET is protected. Agnostic: Supabase, Firebase, REST, GraphQL.

uphiago Skill

Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.

uphiago Skill

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

uphiago Skill

Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.

uphiago Bundle

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

uphiago Skill

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstrated cases.

uphiago Skill

Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.

uphiago Skill

Enumerate hidden tables, fields, and endpoints via API error hints. Agnostic across PostgREST, Zod, FastAPI, GraphQL, and REST.

build-with-dhiraj Skill

Implement unit, widget, and integration tests for a Flutter app. Use for code quality and regression prevention.

grandamenium Skill

Turn any website into a CLI command by driving Chrome's live session. Use when you need structured data from a site that has no API or where the API is inadequate — reads the browser's actual session (logged-in state, cookies) to extract data. Requires Chrome + Browser Bridge extension setup (one-time).

grandamenium Skill

Build applications with the Claude API and Anthropic SDKs. Covers Messages API, streaming, tool use, vision, and best practices.

xspoonai Bundle

AI-powered API integration toolkit for endpoint mapping, schema validation, authentication management, and rate limiting analysis. Maps endpoints from code, validates JSON schemas, detects auth schemes, and analyzes rate limiting strategies.

xspoonai Bundle

Description

xspoonai Bundle

Production-ready DeFi arbitrage system that detects and executes profitable price differences across multiple DEXs using Aave V3 flash loans. Real smart contract integration with Uniswap V3, Curve, and SushiSwap.

xspoonai Bundle

Find, compare, and risk-score DeFi yield opportunities across 20+ protocols and 10+ chains. Includes impermanent loss calculator and strategy recommendations. No API keys required.

xspoonai Bundle

Debug failed EVM transactions by decoding revert reasons, analyzing gas consumption, parsing events, and explaining execution errors across 7 chains. No API keys required.

xspoonai Bundle

Compare, analyze, and risk-score cross-chain bridges across 30+ bridge protocols. Find optimal routes, monitor TVL changes, and detect anomalies. No API keys required.

xspoonai Bundle

Production-ready ERC-4337 Account Abstraction Paymaster infrastructure for sponsoring gas fees with policy controls, real EntryPoint v0.6.0 integration, and multi-chain support. Build, validate, and submit UserOperations with whitelist, limits, and token-gating.

spike-faye-lei Skill

ArkTS/HarmonyOS 代码审查与修复。Use when reviewing or fixing .ets files, HarmonyOS compilation errors, ArkTS type issues, or API deprecation warnings. Covers SDK API 12-24 breaking changes, @kit.* vs @ohos.* imports, strict mode rules, and camera/filesystem API migration.

h-mmer Skill

Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]

xspoonai Bundle

Description

xspoonai Skill

Automate complex workflows and repetitive tasks using AI agents and tool integration. Use when user wants to create automated pipelines, integrate multiple services, or build task-specific agents.

xspoonai Bundle

Description

xspoonai Bundle

Query the Santiment GraphQL API for on-chain, financial, social, and development crypto metrics across 2,000+ assets

garphengate Skill

Run 12 questions against any endpoint before it ships to catch the mistakes that become permanent. Use as the final gate before merging any API change.

uphiago Skill

Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification, and data leakage.

openlabor Skill

Manage customers, invoices, subscriptions, payments, and billing via Stripe Composio connector

openlabor Skill

Design and document APIs

brucesongs Bundle

Open Banking / PSD2 / Open Finance attacks — FAPI (Financial-grade API), OpenID Connect for Financial APIs, OAuth2 PKCE, Strong Customer Authentication (SCA) bypass, AIS/PIS/CBPII API abuse, payment redirection, consent manipulation. Covers UK Open Banking, US FDX, Brazil Open Finance, India Account Aggregator, Singapore MAS APIX, Australia CDR. Includes 2024-2025 incidents (Token Hijacking, IdOR on AIS endpoints, PIS redirect manipulation).

brucesongs Bundle

Building, deploying, and operating stealthy C2 infrastructure for red team engagements. Covers Mythic, Havoc, Sliver, Covenant, PoshC2, Brute Ratel, and Cobalt Strike; redirector chains (Nginx mTLS, Cloudflare workers, CDN domain fronting); dead-drop resolvers; infrastructure OPSEC (compartmentalized servers, auto-rotated certs, decoupled domains); AMIS/GoDaddy API for automated rotation. Use when deploying dedicated adversary emulation infrastructure, planning redirector chains, or testing OPSEC resilience of red team operators.

zhouyinlong-lab Skill

【从零创作】AI 代笔专家——用你自己的语气从零写新消息，不是改已有文本。 分析你的历史消息提取语气特征后，帮你写邮件/Slack/微信回复，读起来像你本人在打字。 如需修改已有文本去AI味，用 humanizer-zh。 Trigger keywords: 代笔, ghostwriter, 帮我回复, 代写消息, 模仿我的语气, 写邮件, 回微信, 回Slack, 用自己的话, 自然语气, 像我自己写的, 个人风格, 帮我写个回复。