Skill UI

An expert developer specializing in secure backend coding practices, vulnerability mitigation, and robust API design. Proficient in preventing common attacks such as SQL injection, XSS, and CSRF. Covers comprehensive areas including input validation, authentication mechanisms (OAuth 2.0, MFA), database security, and implementing necessary security headers (CSP, HSTS) for building secure-by-design applications. Ideal for implementing security fixes or building new, hardened backend services.

Walks through broken authentication assessments by analyzing login flows, password policies, brute-force/credential-stuffing, and session/token security to document vulnerabilities and mitigation steps for web applications.

This skill teaches the critical principles and decision-making processes for safe production releases. It covers platform selection (e.g., Kubernetes, Vercel), mandatory pre-deployment verification (Code Quality, Environment), structured workflows (Prepare, Backup, Deploy, Verify), and advanced strategies like Blue-Green and Canary deployments. Focuses on thinking through risk mitigation, not just executing scripts.

A comprehensive runbook providing structured procedures for responding to Exa search API outages and integration failures. It guides users through initial triage, analyzing specific HTTP error codes (e.g., 401, 429, 5xx), implementing mitigation strategies, and completing thorough post-incident reviews and root cause analyses.

This runbook provides a structured guide for responding to critical Guidewire production incidents. It covers the entire lifecycle of incident management, including initial triage (checking monitoring, API errors, and batch logs), diagnosing performance degradation (JVM metrics and query performance), implementing mitigation steps, and proper escalation procedures to Guidewire Support.

Guides security testers through identifying, exploiting, and remediating insecure direct object references in web apps, with methods covering reconnaissance, request manipulation, Burp Suite automation, and reportable mitigation steps.

A structured playbook for rapidly diagnosing and resolving production incidents related to Lokalise localization services. It guides users through essential quick diagnostics (API health, token validity, rate limits) and provides a decision tree for common failure modes, such as missing or stale translations, API outages, and upload failures, ensuring swift mitigation and postmortem readiness.

This runbook serves as a comprehensive guide for responding to incidents within the OpenEvidence platform. It outlines severity levels (P1-P3), step-by-step triage procedures, and mitigation actions, ensuring rapid and structured resolution of API downtime or degradation issues in a healthcare context.

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

This central skill specializes in performing comprehensive threat modeling using STRIDE and calculating risk via DREAD scoring. It guides users through defining scope, identifying threats, and planning mitigations for new architectures. Crucially, it acts as a security router, directing specialized requests—such as pen-testing, incident response, cloud posture checks, and AI security reviews—to the appropriate dedicated skill.

Provides a structured reference covering the 100 most critical web vulnerabilities, including definitions, root causes, impacts, and mitigation guidance aligned with OWASP categories to support assessments and remediation planning.

This skill scans web application endpoints and cookies to spot missing CSRF safeguards—tokens, double-submit cookies, SameSite attributes, and origin checks—then documents vulnerable paths and mitigation steps for security reviews.