Skill UI

A comprehensive guide and shared vocabulary for designing and structuring complex software modules. Use this when you need to refine an existing module's interface, identify opportunities for deepening its capabilities, determine optimal internal seams, or improve code testability and AI-navigability. It establishes clear principles for Module, Interface, Depth, and Seam.

Use Mailtrap Email Sandbox to capture and inspect outbound emails without sending them to real recipients. This is crucial for development, staging, and CI/CD environments. It allows developers to test email content, headers, attachments, and spam scores using dedicated APIs, SMTP settings, or SDKs, ensuring mail integrity before deployment. Ideal for automation and rigorous quality checks.

This tool evaluates how thoroughly a feature implementation meets product requirements (PRDs) or specifications. It scores acceptance criteria case-by-case, independently grading both the code implementation and the associated test coverage (unit and E2E). Ideal for benchmarking multiple development efforts, auditing adherence to specifications, or determining if a feature is 100% complete and compliant with the ground truth PRD.

This meta-skill provides a comprehensive framework for the entire lifecycle of AI agent skills. It supports creating, refactoring, rigorously evaluating (e.g., Skill OS 2.0 Gates), and securely packaging skills from various sources like workflows, prompts, and documents. It ensures standardized, team-ready, and governed deployment of advanced AI capabilities.

A comprehensive, pre-deployment, defense-in-depth security audit tool for Solidity smart contracts built with Foundry. It combines static analysis (Slither, Aderyn), symbolic execution (Mythril), property-based fuzz testing, and key hygiene checks to proactively detect critical vulnerabilities like reentrancy, access control flaws, and arithmetic bugs before deployment to any EVM chain.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.

A comprehensive, adaptive framework for developing and implementing features, adhering to a strict, multi-phase workflow: Specify, Design, Tasks, and Execute. This skill ensures feature quality through granular task breakdown, atomic Git commits, requirement traceability, and mandatory, independent verification. It automatically adjusts its depth based on feature complexity (Small to Complex), providing a robust mechanism for managing technical debt and capturing project lessons.

This skill guides the deployment and strategic use of honeytokens and canarytokens (decoy credentials, files, URLs, etc.). These high-fidelity decoys are designed to detect unauthorized access, insider threats, or adversary reconnaissance by triggering alerts upon any interaction, providing early warning deep within the kill chain.

A comprehensive tool and methodology for identifying and preventing dependency confusion attacks across major package ecosystems (npm, PyPI, Maven). It detects instances where internal, private package names are leaked and subsequently published publicly by attackers. The skill provides both detection (enumerating claimable internal names) and prevention strategies (enforcing registry pinning and scope restrictions) to secure the software supply chain.

Provides a comprehensive workflow and tooling (GuardDog) to triage npm packages and dependency trees for signs of malicious activity. It focuses on static analysis of install scripts, detecting credential exfiltration, reverse shells, and worming behavior, thereby safeguarding against software supply-chain attacks.

This skill detects malicious, misspelled, or brand-jacked package names (typosquatting) across major ecosystems (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and keyboard-proximity analysis, powered by tools like typomania and OSSGadget, to flag potential supply chain attacks *before* a dependency is installed. It is essential for implementing robust CI/CD security gates and proactive dependency screening.

A powerful CLI and API client for exploring the entire Go ecosystem. It queries pkg.go.dev to provide comprehensive documentation, API references, usage examples, available versions, dependency relationships, and known security vulnerabilities for any Go package or module. Ideal for developers conducting library research, checking compatibility, or auditing dependencies.