Skill UI

Trivy is an open-source, comprehensive security scanner designed for DevSecOps. It assesses container images, Infrastructure-as-Code (Terraform, K8s), filesystems, and SBOMs for vulnerabilities (CVEs), misconfigurations, hardcoded secrets, and license compliance. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, ensuring that code and infrastructure are secure before deployment.

This tool performs static security scanning of declared MCP surfaces using the `harness mcp-scan` command. It reads configuration files like `.mcp/servers.json` and `.harness/claims.json` without executing any tools. The tool flags policy, permission, and dependency issues, exiting with code 1 if findings meet the specified severity threshold. It supports CI integration and graceful degradation when the harness binary is unavailable.

Prevents AI style drift in legacy projects by scanning codebases for implicit conventions, resolving conflicts with users, and generating enforceable .ai-style-rules.md files with golden files, naming rules, and DONTs. Ideal for onboarding AI agents to hand-written legacy codebases or extracting unwritten coding rules.

A comprehensive CI/CD quality gate for Quarkus microservices. This pipeline guides developers through critical stages: build integrity, static code analysis (Checkstyle, SonarQube), thorough unit/integration/API testing with coverage enforcement, dependency vulnerability scanning, native compilation validation (GraalVM), and performance load testing using K6. It ensures high code quality before PR or deployment.

A comprehensive, multi-stage skill designed to simulate a professional Continuous Integration (CI) pipeline. It guides users through critical quality gates, including build verification, type checking, linting, running test suites (with coverage checks), security scanning for secrets, and final diff review. Use this skill before creating a Pull Request or finalizing any significant feature to ensure code robustness and adherence to best practices.

Scan entire codebases or specific changes, audit repositories for security issues, and generate verified patch files. Supports scanning whole repositories, branch diffs, or individual commits. Each finding is verified by an agent panel before reporting. Suggested patches are saved as files for manual review and application. Works in auto mode for streamlined security auditing workflows.

An autonomous system designed to continuously improve code quality by scanning codebase metrics. It functions as an agent, proposing mechanical code changes, executing them, and committing only if defined metrics improve. It supports multiple modes (Scan, Scaffold, Run) for systematic, data-driven codebase refactoring.

This internal skill generates type-safe wrappers for native camera access, image picking, barcode, and QR code scanning. It is essential for integrating custom evidence capture workflows (like dedicated capture screens) into Power Apps or Dataverse mobile applications, ensuring robust data handling for file and image columns.

Analyzes a Power Pages site project's source code and dependencies for various security issues. It runs static analysis (opengrep) and dependency scanning (trivy) to detect vulnerable packages, hard-coded secrets, license compliance problems, and general code patterns. Use this skill to audit code safety, check dependencies, or perform a comprehensive security audit.

This comprehensive wizard guides users through setting up various AI agent clients (e.g., Claude Code, Codex, CodeBuddy) to connect with a Memory Proxy. It handles configuration scanning, gathering necessary credentials (Proxy URL, User Key), selecting the specific agent, and validating connectivity via live API health checks for multiple protocols (Anthropic, OpenAI, etc.) before writing the final configuration.

Secure AI coding agents with permission boundaries, secret protection, code review gates, and safe sandbox configurations for team environments. Covers Claude Code, Cursor, Copilot, and Codex security implementations including CLAUDE.md configuration, command allowlists, filesystem access controls, and pre-commit hooks for secret scanning.

Perform static application security testing to identify vulnerabilities in source code before deployment. Use tools like Semgrep, CodeQL, and SonarQube to integrate security gates into CI/CD pipelines and ensure compliance with secure SDLC practices.