Results for “verified-access”

Integrate verified email retrieval into Android apps using the Credential Manager API and OpenID4VP for secure, OTP-less email verification.

Run pre-deployment validation checks for Azure readiness, including configuration, infrastructure (Bicep or Terraform), RBAC role assignments, and managed identity permissions.

Discover hidden directories, files, APIs, and administrative interfaces by enumerating URLs and testing authentication enforcement during authorized security assessments.

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。 触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。

API Security (Verbose)

Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.

Verify feature, bug, UI, API, mobile, security, or deployment work against acceptance criteria.

Combined verification — recite (description quality via cold-read prediction) + validate (schema compliance) + review (health checks). Use as a quality gate after creating notes or as periodic maintenance. Triggers on "/verify", "/verify [note]", "verify note quality", "check note health".

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

Validates Claude Ads contracts, bundles, scores, runs, capabilities, repositories, and releases with deterministic checks and recovery steps.

Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.

Identify and exploit SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.

Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-less email verification flow into an Android app. This skill solves the problem of high-friction sign-up processes by leveraging cryptographically verified credentials from trusted providers like Google.

Handles all networked operations through a real browser via CDP, including search, page scraping, login-required actions, and social media content extraction.

Acquires a single verified headshot per named leader from official sources, with identity checks and a provenance manifest, avoiding bulk scraping.

Handles all network operations including search, web scraping, login-required access, and social media content retrieval via a real browser CDP proxy.

Queries video analytics incidents, alerts, metrics, and sensor data from Elasticsearch via the VA-MCP server.

Scan AEM Edge Delivery Services pages for WCAG 2.1 AA violations and generate specific fixes for content authors and developers.

Guides authorized Active Directory security research covering Kerberos attacks, AD CS vulnerabilities, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques.

Vercel API skill. Use when working with Vercel for access-groups, artifacts, billing. Covers 281 endpoints.

Audit Microsoft Entra ID (Azure Active Directory) configuration for risky authentication policies, over-privileged role assignments, stale accounts, conditional access gaps, and guest user risks using PowerShell, Graph API, and ScoutSuite.

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them.

Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session isolation, credential rotation policies, and NIST 800-53 integration.

Systematically explores a web application, finds issues, and produces a report with reproduction evidence for each finding.

Audit web interfaces against WCAG 2.1 AA/AAA standards, identify violations, and produce actionable remediation reports with code fixes. Use when the user requests accessibility testing or provides relevant inputs for this workflow.

Enforces identity-based network access with 802.1X, RADIUS authentication, dynamic VLAN assignment, and endpoint posture assessment using PacketFence.

Detect and exploit Broken Object Level Authorization (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities in APIs and web applications.

Implement Google's BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access.

GOF Proxy Pattern

飞书视频会议：搜索历史会议记录、查询会议纪要（总结/待办/章节/逐字稿）、查询参会人快照。当用户查询已结束的会议、获取会议产物（纪要/妙记）、查看参会人时使用；查询未来日程走 lark-calendar。不负责：Agent 真实入会/离会、会中实时事件（走 lark-vc-agent）。

Run authenticated vulnerability scans using valid credentials to deeply inspect target systems for missing patches, misconfigurations, and security weaknesses.

Verifies that every entry in a bibliography ACTUALLY EXISTS by cross-checking it against four keyless public scholarly APIs (Crossref, OpenAlex, Semantic Scholar, arXiv) with a polite mailto identifier, resolving DOI/arXiv IDs, fuzzy-matching title and authors (difflib SequenceMatcher ratio >=0.70), flagging retractions marked in Crossref (update-to) or OpenAlex (is_retracted), and emitting per-entry JSON verdicts mapped to the AlterLab citation-hallucination taxonomy (TF/PAC/IH/PH/SH). Accepts BibTeX, a DOI/arXiv ID list, or free-form references; degrades gracefully offline by emitting 'unverified' verdicts and never silently passing. Use when the request mentions verify citations, check references, fabricated or hallucinated references, fake DOI, retraction check, bibliography audit, or reference existence check. Does NOT write or draft papers — for authoring a manuscript (whose citation-check mode inserts citations) prefer alterlab-paper-writer instead. Part of the AlterLab Academic Skills suite.