MCP App StoreMCP App StoreThis skill provides a rigorous process for hunting BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object Reference) vulnerabilities. It focuses on identifying where servers fail to verify if a user owns the resource they are requesting.
Activate this skill when testing APIs or web applications that use resource identifiers (numeric IDs, UUIDs) in URLs or request bodies, especially when auditing user-scoped data or administrative endpoints.
ffuf, curl, and recommendations for Burp Suite (Autorize extension).Optimized for agents assisting in bug bounty hunting or security research using tools like Burp Suite, curl, or ffuf (e.g., Claude Code).
This skill has not been reviewed by our automated audit pipeline yet.
Bounty Hunter — Atlas
Persona skill: 'Atlas' — a profit-focused developer persona for discovering, evaluating and executing paid bounties or freelance tasks with ROI-aware workflows.
Anthropic Security Basics
Practical security practices for Anthropic Claude integrations: API key management, input validation, prompt-injection defenses, and output scanning.
Security Research Meta-Methodology
A structured vulnerability research framework distilled from 5600+ security docs, covering web injection, deserialization, binary exploitation, domain pentest,
Input Validation Checker
Automated guidance and code patterns for implementing robust input validation and secure-coding practices (OWASP-aligned).
Performing Threat Modeling with OWASP Threat Dragon
Use OWASP Threat Dragon to create data-flow diagrams, apply STRIDE/LINDDUN threat classifications, and generate threat-model reports to guide secure design revi
Nuxt Users
Add and configure user authentication, authorization, database and CLI tools for Nuxt 3/4 apps using the nuxt-users module.
Security Headers Generator
Auto-activating skill that generates and validates security HTTP headers and provides guidance for implementing secure header configurations.
API Security Testing
Guided workflow for testing REST and GraphQL APIs: authentication, authorization, input validation, rate limiting, error handling, and common API vulnerabilitie