Skill UI

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This skill helps users create a new Git branch that strictly adheres to established project naming conventions (e.g., Sentry standards). It automatically determines the appropriate branch type (such as `feat`, `fix`, `chore`, etc.) and generates a descriptive, standardized branch name by analyzing the provided work description or local code differences (diff). It guides the entire branching workflow, ensuring proper lineage and classification for code submissions.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

This assistant streamlines the workflow for managing GitHub issues using the GitHub CLI. It guides users through structured processes to create, list, and view issues. When creating, it prompts for detailed information (including issue type, reproduction steps, and expected vs. actual behavior for bugs), ensuring high-quality issue reports. It also allows filtering and listing of existing issues.

This skill provides a robust and safe mechanism for updating SpecKit templates and configurations from GitHub. It is designed to automatically apply the latest changes while meticulously preserving any existing project customizations, ensuring a non-disruptive workflow. It features a conversational, two-step approval process, guiding the user through the update process, reporting conflicts, and handling fresh installations gracefully. Ideal for developers needing reliable, version-controlled updates to their SpecKit environment.

A comprehensive guide and template for deploying applications from idea to production. It covers modern DevOps practices, including containerization with Docker, robust CI/CD workflows using GitHub Actions, and infrastructure management with AWS SAM and Terraform. Includes setup for monitoring, health checks, and scalable cloud deployments.

This skill guides users on setting up automated code quality gates directly at the Git level. It covers best practices using frameworks like Husky, lint-staged, and pre-commit. Users can enforce linting, formatting, type-checking, and standardized commit message conventions (e.g., Conventional Commits) before code is committed or pushed, significantly improving code hygiene and development workflow consistency.

This skill enforces a mandatory, structured gate for starting new implementation tasks. It mandates that all work must be tracked via a GitHub issue, requiring explicit, testable acceptance criteria before any execution can begin. It defines a strict workflow (Problem, Goal, Scope, Acceptance Criteria, Status) to manage task readiness, ensuring that development only proceeds when criteria are fully defined and verifiable.

A specialized tool and workflow for investigating supply chain attacks. It helps security analysts analyze compromised software updates, trojanized binaries, and dependency artifacts by comparing legitimate versions against suspect files. Key functions include binary diffing, identifying injected code, and documenting code signing anomalies to determine the scope of a security breach.

This comprehensive forensic workflow guides investigators through the extraction and detailed analysis of Windows Registry hives (SAM, SYSTEM, SOFTWARE, etc.). It is used during incident response to uncover critical artifacts, including user activity history, malware persistence mechanisms (autorun keys), installed software records, and evidence of system compromise.

This comprehensive guide details how to design and implement an end-to-end DevSecOps pipeline leveraging GitLab CI/CD. It integrates crucial automated security checks—such as SAST, DAST, container scanning, dependency scanning, and secret detection—directly into the development workflow. By adopting this approach, teams can effectively 'shift left' security, identifying and mitigating vulnerabilities early in the development lifecycle to ensure compliance and robust application security.

This tool scans GitHub Actions workflows and CI/CD configurations to identify critical supply chain attack vectors. It specifically checks for unpinned actions, risks from script injection using expressions, dependency confusion, and secrets exposure, helping organizations harden their build systems against sophisticated threats.