Skill UI

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Performs a comprehensive external audit of a deployed repository's state, going beyond simple code review. It checks for critical production gaps, including RLS misconfigurations, webhook idempotency issues, secret exposure, deployment health, and prompt injection vulnerabilities. Ideal for pre-launch gates and ensuring code stability before going live.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Automate security regression testing for Large Language Model (LLM) applications by integrating Promptfoo and DeepTeam into CI/CD pipelines. This skill enforces a critical security gate, automatically testing endpoints against OWASP LLM Top 10, OWASP Agentic threats, and common jailbreaks/prompt injections. It ensures that security patches do not regress over time due to prompt or model changes, providing continuous risk monitoring.

This guide provides a structured approach to red-teaming Large Language Models (LLMs) to detect sensitive data leakage from system prompts. It simulates advanced attacks—including prompt injection, instruction override, and encoding tricks—to identify embedded secrets, API keys, and proprietary business logic. Essential for validating adherence to OWASP LLM07 and securing AI applications against data exfiltration.

A comprehensive red-teaming skill for assessing the security posture of Retrieval-Augmented Generation (RAG) pipelines. It systematically probes two critical injection surfaces: poisoned retrieved context (indirect prompt injection) and embedding manipulation. Use this skill to validate retrieval guardrails, ensure data leak prevention, and demonstrate vulnerabilities in LLM-powered knowledge assistants.

This example demonstrates unsafe or malicious review data inputs, specifically designed for calibration and security testing. It simulates prompt injection attacks and must only be used in controlled environments to validate secure data processing and system robustness.