Skill UI

This comprehensive skill guide provides deep insight into Oracle Cloud Infrastructure (OCI) IAM policy syntax and best practices. It covers the privilege verb hierarchy (inspect, read, use, manage), the correct structure for policy statements, and common patterns for granting least-privilege access across various compartments. Use this when developing automation scripts, setting up complex access control policies, or performing security audits in OCI.

This guide implements comprehensive policy guardrails for robust Salesforce integrations. It provides solutions for preventing SOQL injection vulnerabilities, detecting hardcoded credentials, throttling API usage at runtime, and enforcing code quality via custom ESLint rules and CI/CD checks. Use this when building secure, scalable, and compliant Salesforce applications.

Implement comprehensive automated policy enforcement for Shopify apps, ensuring security and adherence to App Store guidelines. This skill includes ESLint rules for detecting hardcoded API secrets, enforcing GraphQL query cost budgets, and running pre-commit hooks and CI checks for critical compliance validations (e.g., GDPR webhooks). Use it when hardening a production-ready Shopify application.

This skill provides comprehensive guidance on implementing robust data governance and security guardrails within Snowflake. It covers advanced features such as network rules, mandatory authentication policies (MFA, Key Pair), session timeouts, and statement-level controls. Use this when enforcing strict security policies, achieving regulatory compliance, or structuring robust data access controls for a Snowflake environment.

A comprehensive guide to setting up a local development loop for WebContainer applications. This setup utilizes Vite for a modern development environment, providing hot module replacement (HMR) and cross-origin policy configuration. It includes detailed steps for running Vitest tests, ensuring file system operations and browser-based IDE features function correctly in a simulated local environment.

This comprehensive guide details essential security practices for deploying WebContainers. It covers implementing Content Security Policy (CSP) headers, ensuring robust sandbox isolation, and performing rigorous input validation to mitigate common web vulnerabilities. Use this when developing applications with WebContainers or the StackBlitz SDK.

Manage and apply custom policies to customize readiness scoring across development artifacts. Users can set pass-rate thresholds, override criteria impact, or disable irrelevant checks to tailor scoring to specific organizational standards or project needs. Essential for CI gating and ensuring compliance.

This comprehensive guide details advanced techniques for circumventing Content Security Policies (CSP). It covers exploiting weaknesses in critical directives (e.g., base-uri, object-src), abusing nonces, leveraging trusted CDN endpoints, and executing code despite strict controls like script-src 'self' or 'strict-dynamic'. Essential knowledge for deep security auditing and penetration testing.

This meta-skill implements a combinator pattern for deep security analysis. It runs three independent gates—policy governance, secret scanning, and audit logging—over a candidate operation. It enforces a strict arbitration rule (Policy DENY > Scanner WARN > ALLOW) to provide a robust, multi-layered verdict, making it ideal for reviewing critical code changes or environment modifications for safety compliance.

This skill mints tamper-evident, post-quantum-signed receipts for consequential agent actions (e.g., deployment, payment, access grant). It records who, what, and under which policy the action occurred, ensuring the evidence cannot be altered later. By providing verifiable proof from the certificate alone, it is crucial for meeting regulatory compliance requirements, such as the EU AI Act, and building auditable, trustworthy systems.

This skill is designed to mitigate false-positive safety triggers from strict AI classifiers (e.g., cyber, bio/chem, reasoning). It operates by making minimal, surgical edits to sensitive phrases, abstracting away specific domains or actions while preserving the original benign intent and structure. It ensures the prompt remains policy-compliant without losing its core purpose, making it ideal for academic or defensive inquiries.

Performs a pure, read-only static security scan of a harness's declared MCP surfaces. It analyzes policy, permission, and dependency issues by reading manifest files (e.g., .mcp/servers.json and .harness/claims.json) without executing any underlying tools. Designed for integration into CI/CD pipelines to enforce security policies and ensure compliance.