Skill UI

A comprehensive, multi-phase checklist designed for the systematic rollout of AI coding assistants (like Windsurf) to development teams or entire enterprises. It covers critical areas including workspace configuration, security hardening (SSO/SAML, secret management), establishing team AI policies, structured developer onboarding, key performance indicator (KPI) monitoring, and emergency rollback procedures.

A comprehensive guide to securing development workspaces using Windsurf. This skill teaches how to apply best practices for workspace isolation, prevent sensitive data (secrets, PII) from leaking into AI indexes, manage telemetry, and ensure compliance by configuring exclusion files and security rules.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

Provides red team workflows combining subdomain enumeration, live host discovery, technology fingerprinting, XSS hunting, API fuzzing, and automated recon scripting to support bug bounty hunters and security researchers.

Systematically examines project dependencies, using GitHub data to highlight single-maintainer, unmaintained, unpopular, or otherwise risky packages before audits so teams can focus security efforts and propose better-maintained alternatives.

A specialized assistant designed to act as a senior software architect. It critiques code generated by AI tools or rapidly prototyped code, moving beyond simple syntax checks. The auditor identifies deep structural flaws, technical debt, architectural weaknesses, and production risks (e.g., security vulnerabilities, poor error handling, tight coupling) that make code fragile or unsuitable for deployment.

This guide provides a comprehensive walkthrough for developing and deploying Apify Actors. Actors are serverless, containerized applications designed for powerful tasks like web scraping, data processing, and complex automation. Learn the mandatory setup, template selection (Python, JS, TS), step-by-step development workflow, and crucial security best practices for building robust, production-ready data pipelines.

A comprehensive security scanner designed to audit AI agent skills before deployment. It analyzes source code (Python, Bash, JS), detects critical vulnerabilities like command injection, network exfiltration, and unsafe deserialization. Furthermore, it scans markdown files for prompt injection attacks, and assesses dependency supply chain risks, providing a clear PASS/WARN/FAIL verdict and remediation guidance.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

This skill establishes a rigorous framework for building deep architectural context by performing ultra-granular, line-by-line analysis of code. It applies methodologies like First Principles and 5 Whys to maintain a stable, evolving mental model of the entire system, making it essential for pre-vulnerability security auditing, threat modeling, and complex architecture reviews.

A command-line utility designed to search, extract, and analyze data from Burp Suite project files (.burp). It allows users to search request/response headers and bodies using complex regex patterns, extract security audit findings, or gather proxy/site map data. Essential for deep analysis of captured HTTP traffic in web security testing, while providing safeguards against large data overflows.