Skill UI

Automates 21risk workflows through Composio's 21risk toolkit via Rube MCP, guiding users to discover tools, verify active connections, and run schema-compliant executions with explicit memory and session management.

This skill scans session management code to spot insecure IDs, missing expirations, and fixation risks, then summarizes findings and remediation steps for developers needing a session-security audit.

This structured workflow guides the systematic, low-risk modernization of legacy systems using the Strangler Fig pattern. It provides a phased approach, starting with comprehensive assessment (risk, dependency mapping), establishing robust test coverage (contract testing, data management), and implementing incremental migration infrastructure (API gateways, feature flags) to ensure continuous business operation during the transition.

Provides ISO 27001 ISMS audit and certification guidance, covering program planning, risk-based execution, Annex A control assessment, finding management, and Stage 1/Stage 2 documentation support for compliance teams.

This guide outlines best practices for securing PostHog API keys. It differentiates between low-risk Project keys and high-privilege Personal keys, detailing methods for implementing least-privilege access, scoped key creation, secure rotation procedures, and leak prevention using environment variables, pre-commit hooks, and server-side isolation.

This workflow guides SOC teams in establishing a comprehensive, structured process for vulnerability management. It utilizes major scanning tools (Nessus, Qualys, OpenVAS) to discover, prioritize, and track remediation of security weaknesses across the infrastructure. It integrates threat intelligence (CISA KEV) and asset criticality into risk scoring, ensuring resources are focused on the most critical threats.

This skill audits Azure Blob and ADLS storage accounts for critical security misconfigurations. It checks for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, and outdated TLS versions. Using the Python SDK, it generates a detailed, risk-scored report to enhance cloud security posture management and detect potential data exposure risks.

Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score all APIs (internal, external, partner, shadow). It aggregates security findings from DAST, SAST, SCA, and runtime monitoring to provide a unified, continuous view of API risk and compliance across the enterprise.

This skill automates the process of vulnerability prioritization by querying the FIRST Exploit Prediction Scoring System (EPSS) API. It calculates the real-world probability of a CVE being exploited within 30 days, providing a crucial risk metric that surpasses traditional CVSS severity scoring. Use it for risk-based vulnerability management, allowing security teams to efficiently triage and remediate the most actively threatened vulnerabilities first.

This tool implements critical NERC CIP controls for Bulk Electric System (BES) cyber systems, covering asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013). It is essential for maintaining compliance, preparing for audits, and commissioning new BES assets.

This guide details the systematic workflow for patch management, covering the entire lifecycle from vulnerability discovery and risk assessment to controlled testing, multi-phased deployment, and final verification. Learn how to integrate tools like WSUS, SCCM, and Ansible into a robust, automated process to significantly reduce the attack surface and ensure compliance across enterprise IT infrastructure.

This skill guide provides a comprehensive framework for automating the secure rotation of service account credentials. It addresses the challenge of managing long-lived secrets across diverse environments, including Active Directory, AWS, GCP, Azure, and databases. By implementing centralized secrets management (like HashiCorp Vault) and automated workflows, users can systematically eliminate stale credentials, dramatically reducing the risk of security breaches and non-compliance.