Skill UI

A comprehensive skill for triaging npm packages and dependency lockfiles against supply-chain threats. It utilizes heuristic scanning (GuardDog), manual tarball inspection, and dynamic detonation in isolated environments to detect malicious behavior such as credential exfiltration, reverse shell execution, and self-propagation. Essential for secure code review and CI/CD pipeline gating.

A critical security tool for detecting typosquatted, brandjacked, or misspelled packages across major registries (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and corpus matching to proactively screen dependency names before installation. Ideal for implementing CI/CD gates, auditing lockfile diffs, or reviewing dependency lists sourced from AI models to mitigate supply chain attacks.

This comprehensive guide covers the process of creating, analyzing, and securing Software Bills of Materials (SBOMs). It utilizes Syft to generate standards-compliant SBOMs (CycloneDX or SPDX) from container images and filesystems. The workflow details correlating these SBOMs with known CVEs using Grype for vulnerability analysis, and subsequently signing the artifacts with Cosign. This process is crucial for establishing supply chain trust, ensuring dependency visibility, and integrating vulnerability gating into CI/CD pipelines.

Trivy is an open-source, comprehensive security scanner designed for DevSecOps. It assesses container images, Infrastructure-as-Code (Terraform, K8s), filesystems, and SBOMs for vulnerabilities (CVEs), misconfigurations, hardcoded secrets, and license compliance. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, ensuring that code and infrastructure are secure before deployment.

This skill provides methods to verify artifact signatures and SLSA provenance using tools like cosign and slsa-verifier. It is crucial for building secure CI/CD pipelines, detecting supply-chain attacks (e.g., tampering, compromised builds), and ensuring that deployed artifacts originate from trusted sources and build environments. Key features include enforcing keyless OIDC identity pinning and validating SLSA Build Levels.

A specialized diagnostic skill designed to analyze failing GitHub Actions workflow logs. It identifies the root cause of crashes, such as missing secrets, environment mismatches, or deprecated syntax. The output provides precise YAML or code diffs required to fix the pipeline and optimize CI/CD processes.

This skill helps diagnose, repair, and prevent complex Drizzle Kit database migration conflicts. It addresses issues arising from merging branches, rebasing, or PR updates involving generated SQL, snapshots, and journals. Use it to ensure stable schema evolution in multi-developer teams and harden CI/CD workflows.

This skill manages the end-to-end lifecycle of cloud test execution using HyperExecute for platforms like LambdaTest/TestMu AI. It provides comprehensive functionality to analyze projects, generate and validate complex YAML configurations, run CLI jobs, and debug failures. Ideal for integrating robust, scalable, and matrix-based testing into CI/CD pipelines.

Generate comprehensive, ready-to-use CI/CD pipeline configurations for running automated API tests using Newman. This skill provides templates for major platforms like GitHub Actions, GitLab CI, Jenkins, and Azure DevOps. It ensures seamless integration of Postman collections into automated build processes, including setting up environment variables, running tests, and publishing detailed JUnit and HTML reports.

This skill automates the process of running Postman API collections using Newman CLI. It generates comprehensive scripts, including basic CLI commands, robust shell scripts, and multi-stage Jenkins pipelines. Ideal for integrating API tests into CI/CD workflows, executing data-driven tests, and ensuring reliable automation in any environment.

Provides championship-grade repository hygiene and health checks. It systematically audits critical areas, including dependency health, CI/CD pipeline alignment, documentation synchronization, and detecting stray artifacts. The tool generates a prioritized, actionable cleanup plan and offers auto-fix capabilities to keep codebases pristine and production-ready.

This skill drives an existing browser instance using the Chrome DevTools Protocol (CDP). It is essential for complex web automation tasks that require visible interaction, JavaScript execution, or handling authenticated, stateful sessions. Use it when static data fetching is insufficient, such as simulating user logins, interacting with iframes, or performing visual verification. Supports headless and remote environments.