Skill UI

This skill guides users on fine-tuning CodeRabbit's review quality. It teaches the AI agent team preferences through PR feedback, integrates custom code guidelines (e.g., security policies), allows customization of the review tone, and implements path filters to drastically reduce false positives and noise. This ensures that all code feedback is highly relevant, actionable, and aligns with specific team standards.

Guides writing high-quality YARA-X detection rules for malware hunting, covering naming conventions, string selection, performance tuning, migrations from legacy YARA, and reducing false positives when authoring, reviewing, or debugging signatures.

Systematically verifies suspected security bugs to eliminate false positives and document evidence, guiding each finding through the standard or deep verification path and producing TRUE POSITIVE or FALSE POSITIVE verdicts.

This skill provides a comprehensive guide for creating production-quality custom Semgrep rules. It teaches best practices for detecting security vulnerabilities, enforcing robust coding standards, and identifying specific bug patterns. By emphasizing a test-first approach and utilizing advanced techniques like taint mode, users can write highly accurate static analysis rules that drastically reduce false positives.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

This skill guides the systematic management of Indicators of Compromise (IOCs). It covers the entire lifecycle, from initial discovery and validation through enrichment (e.g., VirusTotal, Shodan) and deployment to SIEM/IDS. Key features include confidence decay over time, false positive tracking, and automated retirement policies, ensuring the threat intelligence database remains high-quality and actionable.

This tool provides a structured methodology for triaging web application security findings generated by DAST and SAST scanners (e.g., Burp Suite, ZAP). It validates true positives, dismisses false positives, and assigns risk ratings using the OWASP Risk Rating Methodology (Risk = Likelihood x Impact). Use it to reduce alert fatigue and prioritize remediation efforts for development teams, ensuring focus on the most critical vulnerabilities.

This guide details the process of developing precise YARA and YARA-X rules for advanced malware detection. It teaches analysts how to analyze unpacked malware artifacts—such as unique strings, byte sequences, and PE header traits—to extract stable detection anchors. This skill is crucial for threat hunting, malware family classification, and automating the creation of robust security signatures while aggressively minimizing false positives.

Analyzes Terraform plan JSON from the AzureRM provider to filter false-positive Set-type attribute diffs when reviewing changes to gateways, load balancers, NSGs, and similar resources.

This skill guides the deployment of decoy files, or "canary tokens," across critical file systems. These files act as tripwires, monitoring for unauthorized changes (modification, deletion, renaming). By tracking these high-value decoys, systems can detect ransomware encryption activity in real-time, providing a low false-positive, high-fidelity detection layer that complements traditional EDR and backup solutions.

This skill is designed to mitigate false-positive safety triggers from strict AI classifiers (e.g., cyber, bio/chem, reasoning). It operates by making minimal, surgical edits to sensitive phrases, abstracting away specific domains or actions while preserving the original benign intent and structure. It ensures the prompt remains policy-compliant without losing its core purpose, making it ideal for academic or defensive inquiries.

This protocol provides a systematic, multi-step diagnostic approach to determine if a command failure (e.g., permission denied, network issues) is genuinely due to sandbox restrictions or is caused by environmental or measurement errors. It includes eight critical checks—such as verifying shell scope and reading real exit codes—to eliminate false positives before filing a blocker report.