Skill UI

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.

Guides you through building custom Semgrep rules with a testing-first workflow, AST analysis, and taint-mode preference to catch vulnerabilities or bug patterns while steering clear of overly broad or unverified shortcuts.

Ports an existing Semgrep rule into each requested language by running applicability analysis, test-first creation, AST-informed rule translation, and validation so that every target-language variant has its own rule+test directory.

A comprehensive skill set for modern frontend development using React, Next.js, TypeScript, and Tailwind CSS. It covers automated project scaffolding, component generation (including hooks and stories), and critical bundle analysis. Use this to enforce best practices, optimize performance, and maintain high code quality in large-scale web applications.

A comprehensive toolkit for the full software development lifecycle. It guides stack selection using a detailed decision engine, automatically scaffolds complex boilerplate projects across multiple popular stacks (Next.js, MERN, FastAPI, Django), and provides deep code quality analysis. Features include security vulnerability detection, complexity scoring, and dependency auditing, ensuring high-quality development from the start.

A specialized methodology for reviewing APIs, configuration schemas, and interfaces to identify 'footguns'—design choices where the path of least resistance leads to insecurity. This analysis focuses on making secure usage the default, covering topics like dangerous defaults, primitive vs. semantic type safety, and insecure algorithm selection. It is crucial for architects and reviewers to prevent developer misuse at the design level.

A comprehensive guide to configuring and utilizing ShellCheck for static analysis of shell scripts (Bash, sh, POSIX). This tool detects common programming pitfalls, enforces best practices, and helps ensure script reliability and portability. Ideal for setting up linting in CI/CD pipelines, pre-commit hooks, or maintaining code quality standards across a development team.

A comprehensive guide and setup for building a fast, reliable local development workflow for language learning applications. It includes setting up mock tutor responses for offline testing, generating audio test fixtures using TTS, and implementing a debug mode for detailed pronunciation scoring analysis. Ideal for engineers setting up a new Speak-based integration or refining existing test pipelines.

Structured pre-PR verification loop for Spring Boot projects that runs fast-build checks, static analysis, tests with coverage, security scans, formatting gates, and diff reviews to catch issues before deployment.

This skill provides systematic patterns and best practices for transforming slow database queries into high-performance operations. It covers techniques like proper indexing, query plan analysis (e.g., using EXPLAIN), schema design improvements, and resolving common issues like N+1 query problems. Use it to debug performance bottlenecks, reduce database load, and ensure scalable application backends.