Skill rating

Hunt Open Redirect

Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

Hunt Clickjacking

Hunt Missing/Weak Rate Limiting

Hunt file upload bugs

Hunt Host Header Injection

Hunt JWT cryptographic failures

Hunt MFA / 2FA bypass

Hunt Laravel specific vulnerabilities

Hunt Next.js specific vulnerabilities

Hunt Node.js specific vulnerabilities

Hunt NoSQL Injection

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

Hunt CI/CD pipeline vulnerabilities

Hunt CORS Misconfiguration

Hunt gRPC vulnerabilities

Hunt SAML / SSO attacks.

Hunting skill for ssrf vulnerabilities.

Hunt account takeover taxonomy

Hunt client-side DOM vulnerabilities

Administer MongoDB databases. Configure replica sets, sharding, and backups. Use when managing MongoDB deployments.

Export a Remotion video

Party ledger reconciliation: party type, name and PAN/VAT, ledger against statement balance, difference and reason, duplicates, confirmation status and adjustment. Use for balance checks.

Print collateral spec: item, finished/trim size and artwork size including bleed, bleed, colour mode, stock and GSM, finish, safe margin, print method, quantity and unit cost. Use for cards and letter

Mailbox and licence register: employee, account type, aliases, groups, tool, licence cost, 2FA and password policy state, and access-review dates. Use for account provisioning.

Payroll register: gross, allowances, TDS and provident fund deductions, net pay, payment date and statutory reconciliation. Use for salary accounting.

Petty cash register: entry number, date and type, payee and purpose, cash in and out, running balance, cash limit flag, custodian, physical count and variance. Use for petty cash.

Purchase register: supplier, invoice, gross amount, VAT and TDS, net payable, ledger account and payment balance. Use for purchase accounting.

TDS register: payee PAN, payment nature, rate and amount deducted, deposit date and challan reference, return filing and ledger variance. Use for TDS compliance.

Design-token register: colour, typography, spacing and radius tokens with light and dark values, contrast ratio and WCAG level. Use for design system documentation.

Payment voucher register: payment number and date, paid to and purpose, mode, gross amount, TDS rate and deducted, net paid, invoice allocation, ledger and reconciliation status. Use for vouchers.

Receipt register: payer, mode, gross amount received, invoice allocation, unapplied amount and TDS collected. Use for receipt and sales-income accounting.

Audit preparation register: required document, period covered, request and receipt dates, preparer and reviewer, auditor queries and adjustments. Use for assembling an audit file.

Link-in-bio register: label, destination URL, link type, priority order, audience, click tracking, UTM source, schedule, click count and status. Use for link hub tracking.

Brand asset register: asset type, format, dimensions and aspect ratio, colour mode, background variant, clear space, approved and prohibited uses, rights owner and licence. Use for brand control.

Turns raw meeting notes into structured minutes: conclusion first, then decisions / action items / open questions; every action item must have an owner and a deadline. Use when the user pastes meeting

Preserve the coding agent's explicit AAS skill selection as a validated stack and optional evidence.

Review AAS stack manifests, preview plans and selection evidence in Workbench without applying changes.

Discover AAS skills for an explicit task and compare their complete instructions without installing them.

Run assay on a web page you just wrote or changed. It opens the page in a real browser, drives every control, and reports where the page contradicts itself. Local browser checks without an LLM API key

Search indexed YouTube and podcast transcripts for quotes, speakers and clip boundaries with timestamped source links using Arcmira.

Read 31 blockchains over keyless JSON-RPC with MoltNode (balances, blocks, contract calls) and get Chord swap quotes with an unsigned transaction and simulation.

Turn a trading idea, post or video into fixed rules, backtest and paper-trade them, and request a user-approved live agent through Krexa's MCP server. Cannot move funds.

Instrument browser/web apps with the Application Insights JavaScript SDK (@microsoft/applicationinsights-web).

Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction

Provide production-ready shell script templates for common Linux system administration tasks including backups, monitoring, user management, log analysis, and automation. These scripts serve as buildi

Research competitors with Browserbase discovery, enrichment lanes, screenshots, matrices, and HTML reports.

Create a new Rails project

Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.