Skill UI

This skill provides detailed guidance on authoring effective `specs.md` files for autonomous development workflows. It teaches users how to clearly define sprint goals, establish explicit scope boundaries (In/Out of Scope), and configure rigorous testing requirements (QA, UI Testing). This ensures that agentic development remains focused and prevents scope creep.

A powerful agentic workflow for complex software development. Cascade Write mode acts as an autonomous coding agent, allowing users to build features, refactor code across multiple files, run terminal commands, and debug errors—all from a single natural language prompt. Ideal for full-stack development, complex system building, and large-scale code refactoring.

This skill provides a comprehensive, hands-on introduction to Windsurf's core AI capabilities. Users will experience Supercomplete for advanced tab completions, Cascade for agentic chat and direct code modifications (Write mode), and Command for targeted inline code adjustments. It is ideal for developers starting with Windsurf or needing a quick overview of its powerful IDE integrations.

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.

The GitHub Copilot SDK empowers developers to embed advanced, agentic AI workflows directly into their proprietary applications. It provides a programmatic interface to Copilot's production-tested agent runtime, allowing you to define complex agent behaviors, manage tool invocation, process file edits, and implement real-time streaming responses. Ideal for building custom, highly intelligent tools and automating complex tasks across multiple languages (Python, TypeScript, Go, .NET).

This framework implements the OWASP Top 10 standards, specifically tailored for Agentic Applications. It provides a standardized methodology to classify and map diverse security findings—such as prompt injection, tool misuse, and privilege abuse—to ten core risk categories (ASI01-ASI10). It is essential for security teams to systematically assess, prioritize, and remediate vulnerabilities inherent in complex AI agent systems.