Backend

Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft.

Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis.

Web SERVER software (not app-layer) attack techniques — server misconfigs, known server CVEs, path traversal, exposed status/config.

Broken access control - IDOR, privilege escalation, JWT abuse, mass assignment, forced browsing - for web apps and APIs.

SQL injection detection→exploitation→proof for web apps and APIs.

Server-Side Request Forgery detection→internal-access→proof for web apps.

Server-Side Template Injection detection→engine-fingerprint→RCE for web apps.

XML External Entity injection detection→file-read/SSRF→proof for web apps.

Searches current documentation, release notes, API references and public repository issues for libraries, frameworks, SDKs, APIs and CLI tools with `firecrawl…

Manage Boat (boat.dev, formerly Box by Ascii) cloud sandboxes via API, CLI, and SSH.

Use when doing ANY task involving Supabase.

Configure Claude Code authentication for Cyrus — API key, OAuth token, or third-party provider.

Sets up and manages Postgres using the clickhousectl CLI — runs a local Docker-backed Postgres for development, and creates and operates managed ClickHouse…

Write, edit, or debug JavaScript that uses the Note Toolbar `ntb` API inside Obsidian.

API security testing — OWASP API Top 10, BOLA/IDOR chains, mass assignment, excessive data exposure, rate limiting.

Web application pentest methodology + ROUTER to the per-vuln-class web skills.

Build a music video from an existing song and lyrics, either as p5.js/p5.brush animation or by assembling local images and clips.

Add ElevenLabs to a project from scratch.

Fix or hand-configure an existing ElevenLabs API key.

Use MCP (Model Context Protocol) servers from bash with `shelley mcp`.

Use when the user needs Node.js or npm installed, or is running a JS framework dev server (Next.js, Vite, webpack, etc.) on an exe.dev VM — especially if the…

Write, return, validate, or troubleshoot character-faithful spoken replies for RabiRoute's current RabiSpeech workflow.

Manage persistent coding sessions across Claude Code, Codex, Antigravity (agy), Grok Build, and OpenCode engines.

Email marketing operating manual for AI agents, with hard send-safety gates.