Skill UI

Provides comprehensive guidance for setting up and configuring Static Application Security Testing (SAST) tools, including Semgrep, SonarQube, and CodeQL. Learn how to integrate security scanning into CI/CD pipelines, define custom security rules, enforce quality gates, and manage compliance policies to proactively identify and remediate code vulnerabilities across multiple programming languages.

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

Provides Terraform and OpenTofu best-practice guidance for module design, testing selection, CI/CD pipeline setup, security scanning, and architecture decisions in production infrastructure-as-code projects.

A comprehensive guide for implementing secure and reliable webhook endpoints to handle Vercel deployment lifecycle events. This skill covers signature verification (HMAC) to ensure security, processing key events (e.g., deployment.ready, deployment.error), and implementing idempotency to prevent duplicate actions. Ideal for building automated CI/CD integrations, status notifications, or custom project hooks that react to deployment changes in real-time.

This skill provides AI-assisted capabilities for creating and managing Continuous Integration/Continuous Deployment (CI/CD) workflows using GitHub Actions. It can generate new workflows from project requirements, optimize existing pipelines, debug failures, and implement industry-standard security best practices, streamlining the entire development and deployment process.

Automatically monitors YAML workflows to validate syntax, infer schemas, convert formats, and harden Kubernetes/Docker Compose/CI configurations while spotting anti-patterns and security gaps.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

A comprehensive enterprise-grade security engine designed to discover, classify, protect, and govern all credentials, API keys, and secrets across the entire application lifecycle. It provides continuous governance by auditing code repositories, CI/CD pipelines, runtime logs, and infrastructure configurations to prevent exposure and enforce least privilege principles. Ideal for implementing DevSecOps best practices.

This comprehensive index covers 37 advanced engineering skills designed for complex system architecture, platform operations, and reliability. Skills include agent design, RAG implementation, CI/CD, observability, database modeling, and security auditing, supporting the entire development lifecycle for powerful enterprise applications.

Opinionated Terraform workflow skill that guides module design, state/backend management, provider patterns, security hardening, policy-as-code checks, and CI/CD plan/apply flows so IaC stays modular, compliant, and reliable.

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.