Skill UI

Provides practical advice on Dockerfiles, CI/CD pipelines, deployment strategies, infrastructure-as-code, and observability, helping teams containerize apps, configure GitHub Actions, plan production rollouts, and keep deployments secure and observable.

This guide provides expert patterns and code templates for integrating with the HubSpot CRM API. It covers secure authentication methods, including OAuth 2.0 for public apps and Private App Tokens for single-account use. Topics include CRUD operations on CRM objects, handling associations, webhooks, and batch processing. Implementation examples are provided for both Node.js and Python SDKs.

Detects fail-open insecure defaults such as hardcoded secrets, weak auth, or permissive security that allow production apps to run unsafely, guiding auditors through discovery, verification, confirmation, and reporting steps during security reviews or deployment validation.

Automates frontend lazy-loading workflows by guiding best practices, generating React/Vue-ready code, and validating production configurations for accessible, high-performance web apps.

This comprehensive workflow guides the process of building and deploying new features that must maintain consistent functionality and design across multiple operating systems (web, mobile, and desktop). It strictly follows an API-first architecture, starting with defining shared API contracts (OpenAPI/GraphQL) and a unified design system. The process then guides parallel implementation across specialized stacks like React/Next.js, SwiftUI, and Jetpack Compose, ensuring high code consistency and faster time-to-market.

Ruzzy is a coverage-guided Ruby fuzzer leveraging libFuzzer to exercise both pure Ruby code and native C extensions; follow the provided installer, harness patterns, and sanitizer-aware runs to validate Ruby apps or gems for memory safety issues.

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

This specialist simulates the role of an App Store reviewer, auditing iOS source code and metadata against Apple's strict guidelines. It systematically identifies potential compliance risks, technical vulnerabilities, monetization gaps (IAP/Subscriptions), and critical UX shortcomings, delivering a prioritized risk register for fast approval.

This comprehensive scaffold sets up a complete, modern Power Apps Code App project structure using Vite, React, and TypeScript. It guides developers through initializing the project with PAC CLI, configuring SDK integration, and setting up best practices for connecting to 1,500+ Power Platform connectors (e.g., Office 365, SharePoint, SQL Server). Ideal for building complex, code-first enterprise applications within the Power Platform ecosystem.

A comprehensive guide detailing the 10 most common anti-patterns and mistakes when developing apps for the Shopify platform. Covers critical topics including mandatory GraphQL usage, handling userErrors, GDPR compliance, webhook timeouts, and secure API practices. Essential for code audits and App Store preparation.

Implement comprehensive automated policy enforcement for Shopify apps, ensuring security and adherence to App Store guidelines. This skill includes ESLint rules for detecting hardcoded API secrets, enforcing GraphQL query cost budgets, and running pre-commit hooks and CI checks for critical compliance validations (e.g., GDPR webhooks). Use it when hardening a production-ready Shopify application.

This framework enforces high output quality, intellectual honesty, and continuous improvement across all AppSec agents. It mandates structured processes, including self-critique loops, anti-rationalization guards, and self-reflection quality gates (≥8 scoring). Applicable during code review, SAST, SCA, and threat modeling, it ensures rigorous and verifiable security analysis.