Packs

8 packs

Design System Foundation

Create design tokens, principles, and naming conventions for a new design system.

16 skills · pack

Design System Audit and Remediation

Identify design debt, audit tokens, and enforce consistency across a product.

14 skills · pack

Publish Mobile-First Page

Scaffold and publish a mobile-first page with responsive layout and design tokens.

4 skills · pack

React Motion UI System

Install foundational motion tokens, UI patterns, and accessibility enforcement for React/Next.js.

5 skills · pack

Design system skills: component specs, design tokens, naming conventions, spacing and grid systems, accessibility standards, and documentation.

11 skills · pack

Token-compression suite: compressed chat mode plus commit, review, help, stats, memory-compress and subagent-crew skills by Julius Brussee.

7 skills · pack

Visual Critique

Visual critique skills: hierarchy analysis, brand consistency checks against mood/voice/tokens, composition evaluation, and typography audits — with a /critique-screen command that compiles a prioritised fix list.

7 skills · pack

@pwdev-solucoes

Integração com YouTrack Cloud v1.0 — MCP oficial embutido (2025.3+) para issues, busca com query language, comentários, artigos e log de trabalho; fallback REST para agile boards, sprints, relatórios de tempo e anexos; 2 skills, 4 comandos, setup guiado com token no Keychain

2 skills · pack

Results for “token”

21 skills

testing-jwt-token-security

Assess JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

24.6k · bundle

performing-jwt-none-algorithm-attack

Test JWT signature verification bypass by crafting tokens with the 'none' algorithm.

24.6k · bundle

attacking-oauth-with-device-code-phishing

Execute OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services during authorized red-team engagements.

24.6k · bundle

attacking-entra-id-with-roadtools

Enumerate Microsoft Entra ID tenants using ROADrecon and acquire/exchange tokens with roadtx for authorized red-team operations.

24.6k · bundle

exploiting-oauth-misconfiguration

Identify and exploit OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during authorized security assessments.

24.6k · bundle

testing-api-authentication-weaknesses

Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws.

24.6k · bundle

More results

implementing-canary-tokens-for-network-intrusion

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

24.6k · bundle

testing-oauth2-implementation-flaws

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass.

24.6k · bundle

testing-for-json-web-token-vulnerabilities

Test JWT implementations for critical vulnerabilities including algorithm confusion, none algorithm bypass, kid parameter injection, and weak secret exploitation to achieve authentication bypass and privilege escalation.

24.6k · bundle

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

identity-federation

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

12.8k · bundle

Routes API security testing into recon, authorization, token abuse, or hidden-parameter workflows based on observed endpoint characteristics.

extracting-credentials-from-memory-dump

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

24.6k · bundle

testing-mobile-api-authentication

Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities.

24.6k · bundle

performing-privilege-escalation-assessment

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control.

24.6k · bundle

auditing-entra-id-with-aadinternals

Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate identity-attack resilience.

24.6k · bundle

performing-csrf-attack-simulation

Test web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.

24.6k · bundle

performing-initial-access-with-evilginx3

Conduct authorized red team initial access using EvilGinx3 adversary-in-the-middle phishing to capture session tokens and bypass multi-factor authentication.

24.6k · bundle

testing-for-open-redirect-vulnerabilities

Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.

24.6k · bundle

post-exploiting-microsoft-graph-with-graphrunner

Perform reconnaissance, persistence, privilege escalation, and data pillaging on Microsoft 365/Entra ID tenants via the Microsoft Graph API using the GraphRunner PowerShell toolset.

24.6k · bundle

auditing-kubernetes-rbac-privilege-escalation

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

24.6k · bundle