Skill UI

Integrates Aqua Security’s Trivy scanner into CI/CD workflows to automatically scan Docker images, IaC files, and configs for OS and dependency CVEs, enforce severity-based quality gates, and block vulnerable images before deployment.

Guide to systematically assess REST and GraphQL APIs against the OWASP API Security Top 10 risks using Burp Suite, Postman, ffuf, and curl to discover endpoints, probe auth/authorization flaws, and verify rate limiting before deployment.

Identifies open redirect vulnerabilities in web apps by analyzing redirect parameters, applying bypass payloads, and chaining exploits for phishing or token theft during security assessments.

Performs targeted security assessments of JSON Web Token implementations, probing algorithm confusion, claim tampering, brute-force secrets, and misuse during penetration tests of APIs, SSO, and microservice authentication flows.

Vibers provides a human code review workflow for AI-generated GitHub projects; add the collaborator, GitHub Action, and commit guidance to receive spec- and security-focused feedback plus follow-up PR fixes.

Performs structured security assessments of SCADA HMI deployments by validating authentication, web interfaces, and PLC communication protections against IEC 62443 and NIST SP 800-82 requirements to guide OT risk reduction.

A comprehensive 7-stage super workflow designed for advanced GitHub repository management. This tool automates deep audits to detect security secrets, junk files, and code quality issues. It further provides structured PR review capabilities, competitor benchmarking against similar projects, and synthesizes all findings into a prioritized, actionable plan, ensuring your repository is optimized and production-ready.

AegisOps-AI is a professional-grade 'Living Pipeline' that integrates advanced AI reasoning directly into the SDLC. It acts as an intelligent gatekeeper, automating high-stakes audits across three domains: identifying memory vulnerabilities in Linux Kernel patches, detecting massive cost drifts in Terraform plans, and translating natural language security intent into hardened Kubernetes manifests.

This comprehensive workflow guides the design, optimization, and deployment of scalable, cost-effective Google Cloud Platform (GCP) architectures for both startups and large enterprises. It covers the full lifecycle, from gathering detailed requirements (compliance, SLA) and recommending optimal patterns (Serverless, GKE, Data Pipelines) to estimating costs, generating Infrastructure as Code (IaC) using Terraform, setting up CI/CD pipelines, and completing a thorough security review.

Parses CycloneDX and SPDX SBOMs, maps components to the NVD CVE catalog, scores their risk via dependency graphs, and produces compliance-ready reports for supply chain security assessments and automated CI/CD scans.

Deploy deception-based Active Directory honeytokens—fake privileged accounts, SPNs, decoy GPOs and BloodHound paths—to detect Kerberoasting, lateral movement, credential theft and other reconnaissance activity via monitored Windows Security events.

Detect NTLM relay attacks by correlating Windows Security Event 4624 LogonType 3 entries against IP-to-hostname inventories, auditing SMB/LDAP signing enforcement, spotting Responder/LLMNR poisoning traffic, and tagging NTLM downgrade attempts for SIEM alerting.