Skill UI

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Structured PR/MR review workflow that analyzes blast radius, security, breaking changes, and test coverage delta to deliver prioritized findings for GitHub/GitLab pull requests.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This skill helps users create a new Git branch that strictly adheres to established project naming conventions (e.g., Sentry standards). It automatically determines the appropriate branch type (such as `feat`, `fix`, `chore`, etc.) and generates a descriptive, standardized branch name by analyzing the provided work description or local code differences (diff). It guides the entire branching workflow, ensuring proper lineage and classification for code submissions.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

This assistant streamlines the workflow for managing GitHub issues using the GitHub CLI. It guides users through structured processes to create, list, and view issues. When creating, it prompts for detailed information (including issue type, reproduction steps, and expected vs. actual behavior for bugs), ensuring high-quality issue reports. It also allows filtering and listing of existing issues.

This skill provides a robust and safe mechanism for updating SpecKit templates and configurations from GitHub. It is designed to automatically apply the latest changes while meticulously preserving any existing project customizations, ensuring a non-disruptive workflow. It features a conversational, two-step approval process, guiding the user through the update process, reporting conflicts, and handling fresh installations gracefully. Ideal for developers needing reliable, version-controlled updates to their SpecKit environment.

A comprehensive guide and template for deploying applications from idea to production. It covers modern DevOps practices, including containerization with Docker, robust CI/CD workflows using GitHub Actions, and infrastructure management with AWS SAM and Terraform. Includes setup for monitoring, health checks, and scalable cloud deployments.

This skill guides users on setting up automated code quality gates directly at the Git level. It covers best practices using frameworks like Husky, lint-staged, and pre-commit. Users can enforce linting, formatting, type-checking, and standardized commit message conventions (e.g., Conventional Commits) before code is committed or pushed, significantly improving code hygiene and development workflow consistency.

This skill enforces a mandatory, structured gate for starting new implementation tasks. It mandates that all work must be tracked via a GitHub issue, requiring explicit, testable acceptance criteria before any execution can begin. It defines a strict workflow (Problem, Goal, Scope, Acceptance Criteria, Status) to manage task readiness, ensuring that development only proceeds when criteria are fully defined and verifiable.

Implements a full GitLab CI DevSecOps pipeline that plugs SAST, DAST, container, dependency, and secret scanning plus license compliance into CI/CD workflows so teams detect vulnerabilities early and gate artifacts before staging/production deployments.

Scans GitHub Actions workflows and CI/CD pipeline files to flag unpinned actions, expressions that may inject scripts, dependency confusion, and exposed secrets while automating audits for analysts hardening build systems.