Browse Skills

shadcn/ui manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI. Use it when working with shadcn/ui, component registries, presets, or any project with a components.json file.

Upload Photo uploads local image files to Vercel Blob and returns public URLs for sharing. Use it whenever an image or screenshot needs a public URL in PR comments, docs, or sharing.

Voiceover turns a feature request into an approved demo narration before any code, then builds on a fresh worktree and opens a PR with frame-by-frame proof. Use when a feature request arrives or when the user runs /voiceover.

Argus runs six automated scanners for web and LLM vulnerabilities: CORS misconfig, CRLF/host-header injection, NoSQL injection, JWT attacks, blind bug confirmation via OOB, and LLM red-teaming. Use it on JSON APIs, login endpoints, JWT auth, or any parameter that might reach the server.

Bug Bounty guides a complete bug bounty workflow from reconnaissance and vulnerability hunting through validation and report writing, including LLM/AI security testing and A-to-B bug chaining. Use it for any bug bounty task, from starting a new target to writing the final submission.

Bug Bounty provides a complete bug bounty workflow covering reconnaissance, vulnerability hunting, AI/LLM security testing, bug chaining, and report writing. Use it for starting new targets, hunting specific vuln classes, auditing source code, validating findings, or writing reports.

Bug Bounty Methodology structures a hunting session around a five-phase workflow and a critical-thinking framework, so an agent can choose a goal, select techniques, and derive next actions. Use it at the start of a bug bounty session, when switching targets, or when unsure what to do next.

Bug Bounty Report Writing provides templates, tone guidelines, CVSS scoring, and checklists for writing bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi. Use it after validating a finding and before submitting.

CI/CD Security audits CI/CD pipelines for workflow injection, secret exfiltration, self-hosted runner poisoning, OIDC token theft, and supply chain attacks. Use it when a target has public repos or CI/CD infrastructure.

Client Reverse helps bug bounty hunters recover client-side request-signing and anti-bot token logic so they can replay protected API requests outside the browser. Use it when Burp or mitmproxy replay fails with 401/403 and you need to isolate the signer before hunting IDOR or auth issues.

Credential Attack provides a password spray pipeline for bug bounty: wordlist generation, breach checks, employee OSINT, and login spraying (HTTP form, OAuth, O365, Okta). Use it when credential testing is in scope or to avoid rate-limit and lockout pitfalls.

GraphQL Security Audit tests GraphQL endpoints for vulnerabilities such as introspection leaks, field suggestion abuse, batching DoS, IDOR via aliasing, auth bypasses, injection, subscription abuse, and depth bombs. Use it when a target exposes a GraphQL endpoint during security assessments.