Skill UI

A comprehensive guide for configuring and managing organizational access control in Replit Enterprise. This skill covers defining role hierarchies (Owner, Admin, Manager, Editor, Viewer), implementing custom groups, integrating Single Sign-On (SSO/SAML), restricting deployment permissions (Production/Staging), and setting up detailed audit logging. Use this when securing a large development team, setting up strict security policies, or performing quarterly access reviews.

This guide identifies and explains common anti-patterns and critical pitfalls encountered when building applications on the Replit platform. Topics include data persistence, secret management, networking bindings, and environment configuration. Use this resource when conducting code reviews, onboarding new developers, or auditing existing Replit applications for best practices.

This workflow guides developers through the systematic process of requesting and acting upon code reviews. It emphasizes the core principle of reviewing early and often, providing structured inputs (commits, requirements, implemented features) via a subagent to catch technical issues, ensure compliance with requirements, and maintain high code quality before merging.

Apply a rigorous coding standard by explicitly stating assumptions, avoiding unsupported claims, and covering both happy and unhappy paths before writing or reviewing code to ensure reliability.

Expert skill for writing, reviewing, and debugging idiomatic Rust code, focusing on memory safety and zero-cost abstractions. Specializes in advanced concepts like ownership patterns, explicit lifetime management, trait-based API design, and building concurrent async applications using Tokio. Use this when developing high-performance, reliable, systems-level software in Rust.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

Runs external LLM CLIs (OpenAI Codex or Google Gemini) to review uncommitted changes, branch diffs, or specific commits, providing an independent second opinion before merges or releases.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

This central skill specializes in performing comprehensive threat modeling using STRIDE and calculating risk via DREAD scoring. It guides users through defining scope, identifying threats, and planning mitigations for new architectures. Crucially, it acts as a security router, directing specialized requests—such as pen-testing, incident response, cloud posture checks, and AI security reviews—to the appropriate dedicated skill.

A specialized methodology for reviewing APIs, configuration schemas, and interfaces to identify 'footguns'—design choices where the path of least resistance leads to insecurity. This analysis focuses on making secure usage the default, covering topics like dangerous defaults, primitive vs. semantic type safety, and insecure algorithm selection. It is crucial for architects and reviewers to prevent developer misuse at the design level.