Skill UI

This comprehensive workflow guides users through a multi-phase process for assessing web application security. It is designed to systematically test for common vulnerabilities listed in the OWASP Top 10, including SQL injection, XSS, broken authentication, and access control issues. Ideal for professional penetration testing, security auditing, and bug bounty hunting.

This comprehensive guide details how to control and audit the scope of code and data accessible by AI tools (like Codeium or Windsurf AI). Learn to implement robust data exclusion patterns, set compliance boundaries (e.g., HIPAA, GDPR), and configure secure deployment modes, ensuring sensitive data and secrets are never processed or retained by the AI model.

This skill provides comprehensive dependency management for software projects. It analyzes the entire dependency tree to identify security vulnerabilities, suggest safe updates, and help plan major version migration paths. Use this when performing security audits, managing third-party library updates, or planning complex project upgrades.

This guide outlines common anti-patterns and critical mistakes when using the Windsurf AI IDE. It covers best practices for prompt engineering, managing workspace scope (especially in monorepos), distinguishing between Supercomplete and Cascade usage, and ensuring safe, maintainable AI-assisted coding workflows. Essential for new developers and team auditors.

Provides Wycheproof test vectors for validating cryptographic implementations against known attacks and edge cases, making it ideal for CI regression sweeps and third-party crypto audits.

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Systematically examines project dependencies, using GitHub data to highlight single-maintainer, unmaintained, unpopular, or otherwise risky packages before audits so teams can focus security efforts and propose better-maintained alternatives.

Detects missing zeroization of secrets and flags compiler-optimized removals with mandatory assembly/IR evidence, helping auditors verify C/C++/Rust cryptographic code through dataflow, CFG, and runtime validation.

A specialized assistant designed to act as a senior software architect. It critiques code generated by AI tools or rapidly prototyped code, moving beyond simple syntax checks. The auditor identifies deep structural flaws, technical debt, architectural weaknesses, and production risks (e.g., security vulnerabilities, poor error handling, tight coupling) that make code fragile or unsuitable for deployment.

Automatically scans modern API frameworks (Next.js, Express, FastAPI, Django) to generate comprehensive, ready-to-run test suites. It ensures complete coverage for critical areas including authentication, input validation (boundary/injection), error code matrices, pagination, file uploads, and rate limiting. Ideal for TDD, contract testing, and security audits.

This powerful tool helps translate natural language requirements into robust, normalized relational database schemas. It can generate comprehensive schema designs, complete with relationships, constraints, and advanced architectural concerns like multi-tenancy, soft deletes, and audit trails. Furthermore, it automates the generation of database migrations (supporting Prisma, TypeORM, Alembic, etc.), corresponding type definitions (TypeScript/Python), seed data, and Entity-Relationship Diagrams (ERD) using Mermaid.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.