Skill UI

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Provides Terraform and OpenTofu best-practice guidance for module design, testing selection, CI/CD pipeline setup, security scanning, and architecture decisions in production infrastructure-as-code projects.

This comprehensive workflow provides a complete cycle of quality assurance for software development. It covers every stage from defining the test strategy (TDD, Unit Testing) through integration, E2E testing, browser automation, performance profiling, security scanning, and final code review. Use this when setting up robust testing infrastructure or ensuring production-ready software quality.

Automated skill that assists with XSS vulnerability scanning tasks, delivering best-practice guidance, secure patterns, code/configuration samples, and output validation for Security Fundamentals needs.

A powerful skill for conducting structured, systematic code reviews for PRs and MRs. It goes beyond basic style checks, performing deep analysis such as blast radius tracing, comprehensive security scanning (SQLi, XSS, secrets), detecting breaking changes in APIs/DB schemas, and calculating test coverage delta. Ideal for reviewing large, complex, or security-sensitive code changes before merging.

Learn how to implement robust container security by integrating the open-source Trivy scanner (from Aqua Security) into your CI/CD pipelines. This guide covers scanning container images, Kubernetes manifests, IaC files, and code repositories to detect critical vulnerabilities, misconfigurations, secrets, and generating Software Bill of Materials (SBOM) for comprehensive supply chain security.

Utilizes GitHub Advanced Security (GHAS) and CodeQL to implement comprehensive SAST across enterprise repositories. This solution automates static analysis, detecting vulnerabilities (e.g., SQL injection, XSS) and secrets at scale, enabling true 'shift-left' security by integrating checks directly into pull request workflows and CI/CD pipelines.

Automate security scanning for Infrastructure as Code (IaC) using best-in-class tools like Checkov and tfsec. This method analyzes Terraform, CloudFormation, and Kubernetes manifests to detect misconfigurations, enforce policy-based governance, and prevent common security vulnerabilities (e.g., public S3 buckets) before deployment. Essential for establishing secure CI/CD pipelines and meeting compliance standards.

This skill guides the implementation of Gitleaks for robust secret scanning across development lifecycles. It covers setting up pre-commit hooks to prevent secrets from being committed, integrating scanning into CI/CD pipelines (like GitHub Actions), and writing custom regex rules to detect and remediate hardcoded credentials (API keys, passwords, tokens) in Git history, ensuring adherence to secure SDLC practices.

This skill guides the integration of gitleaks and trufflehog into CI/CD pipelines. It automates the detection of hardcoded secrets, such as API keys, passwords, and tokens, preventing their accidental deployment. By integrating scans as a mandatory pre-deployment gate, organizations enforce strong security policies and maintain compliance.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

Extracts business domain knowledge from a codebase, optionally reusing an existing knowledge graph, and generates an interactive horizontal flow graph for dashboard visualization, with lightweight scanning and validation steps.