Skill UI

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Scans a Claude skill directory for security risks before adoption, detecting prompt injection, malicious code, overbroad permissions, secrets, and supply-chain issues via the bundled scan_skill.py tool, and supports a manual review workflow.

Security guardrails embedded in the mortgage plugin that block prompt injection and social-engineering tricks, stop system prompt extraction, guard PII and pricing logic, enforce workflow phases, and ensure conversational inputs stay within refinance scope.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.