Skill UI

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

Kubesec is a powerful open-source tool designed to perform comprehensive security risk analysis on Kubernetes resource manifests (YAML/JSON). It automatically detects critical misconfigurations, potential privilege escalation vectors, and deviations from industry security best practices. It provides actionable scoring and hardening recommendations, making it essential for CI/CD pipelines, security auditing, and automated compliance checks.

This skill provides a comprehensive guide and methodology for identifying and exploiting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It covers testing origin validation bypasses, analyzing preflight requests, and simulating data exfiltration during authorized penetration tests, crucial for assessing API security.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

Performs a comprehensive external audit of a deployed repository's state, going beyond simple code review. It checks for critical production gaps, including RLS misconfigurations, webhook idempotency issues, secret exposure, deployment health, and prompt injection vulnerabilities. Ideal for pre-launch gates and ensuring code stability before going live.

This comprehensive playbook guides the testing of Cross-Origin Resource Sharing (CORS) misconfigurations. It focuses on detecting critical vulnerabilities such as reflected origins, wildcard trust misuse, credentialed cross-origin reads, and bypasses in origin allowlists. Use this when analyzing browser-based access and trust boundaries for authenticated APIs.

A comprehensive playbook for testing security flaws in OAuth 2.0 and OpenID Connect (OIDC) implementations. Use this guide to systematically check for misconfigurations in redirect URI handling, state and nonce validation, PKCE enforcement, token audience/issuer checks, and account binding vulnerabilities. Essential for reviewing applications linked to external identity providers.

This skill performs an adversarial audit of web application authentication flows. It systematically probes for critical security vulnerabilities such as missing CSRF protection, insecure session cookies (lacking Secure/HttpOnly flags), risky cross-origin redirects, and OAuth misconfigurations. It generates a structured report detailing findings and severity levels, making it ideal for pre-deployment security audits and regression testing.

A comprehensive security auditing tool designed for Claude Code environments. It scans the entire configuration directory for security vulnerabilities, misconfigurations, injection risks, hardcoded secrets, and overly permissive settings. Ideal for initial project setup, pre-commit checks, or routine security hygiene.