Skill UI

Perform comprehensive and structured API security testing using Postman. This skill covers testing for OWASP API Security Top 10 vulnerabilities, including authentication bypass, authorization flaws (BOLA), injection, and data exposure. It guides users through setting up multi-role environments, writing automated test scripts for regression testing, and integrating the workflow with CI/CD tools like Newman and OWASP ZAP.

This skill demonstrates how to use Trivy, an open-source security scanner, to perform comprehensive container security assessments. It scans container images, Kubernetes manifests, and Infrastructure as Code (IaC) files for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues. Key features include generating Software Bill of Materials (SBOM) for supply chain transparency and integrating scanning gates into CI/CD pipelines, supporting robust DevSecOps practices.

This skill details implementing Software Composition Analysis (SCA) using Snyk. It helps security teams detect known vulnerabilities, check license compliance, and automate dependency remediation within CI/CD pipelines. Learn to integrate scanning into GitHub, GitLab, and Jenkins workflows, generate automated fix PRs, and continuously monitor deployed applications to safeguard the software supply chain.

A comprehensive guide for security professionals detailing how to exploit web cache mechanisms (CDNs, reverse proxies) to inject malicious content. It covers identifying caching layers, discovering unkeyed headers (like X-Forwarded-Host), and executing poisoning attacks for authorized penetration testing.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.

Kubesec is a powerful open-source tool designed to perform comprehensive security risk analysis on Kubernetes resource manifests (YAML/JSON). It automatically detects critical misconfigurations, potential privilege escalation vectors, and deviations from industry security best practices. It provides actionable scoring and hardening recommendations, making it essential for CI/CD pipelines, security auditing, and automated compliance checks.

This comprehensive workflow guides the design, optimization, and deployment of scalable, cost-effective Google Cloud Platform (GCP) architectures for both startups and large enterprises. It covers the full lifecycle, from gathering detailed requirements (compliance, SLA) and recommending optimal patterns (Serverless, GKE, Data Pipelines) to estimating costs, generating Infrastructure as Code (IaC) using Terraform, setting up CI/CD pipelines, and completing a thorough security review.

This skill provides comprehensive automation for managing GitHub workflows across the entire development lifecycle. It covers detailed issue triage, PR review status checks, CI/CD failure debugging, official release management, and security monitoring using the GitHub CLI. Ideal for maintaining open-source project health and streamlining team development processes.

Automates CI/CD pipeline setup, from linting and type checks to integration, E2E, security, and deployment stages, plus feedback loops for AI agents and preview deployments.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. This skill covers essential quality gates including unit testing, linting (golangci-lint), static analysis security testing (SAST), vulnerability scanning, dependency management, Docker builds, and automated releases using GoReleaser.

This skill provides comprehensive linting and static analysis for Go projects using golangci-lint. It enforces numerous best practices, checks for common errors, manages configurations via `.golangci.yml`, and supports auto-fixing. Use it during the entire development lifecycle, including setting up CI/CD pipelines, running pre-commit checks, or refactoring large, legacy Go codebases to ensure high code quality and maintain security standards.

Implements automated, multi-layered policy enforcement and guardrails for Adobe integrations. This skill provides crucial security checks, including detecting sensitive credentials (e.g., p8_ secrets), pre-screening content for services like Firefly (blocking trademarks or explicit material), and enforcing usage quotas for PDF Services. It is essential for maintaining secure and compliant CI/CD pipelines.