Skill UI

This comprehensive tool guides developers through the entire plugin ecosystem, helping them find and recommend the optimal plugins for any given workflow or task. It covers core coordination, multi-agent collaboration, advanced memory management (Vector DB, RAG), architectural design (ADR/DDD), security auditing, and modern development methodologies. Use it when starting a new project or optimizing existing development pipelines.

A comprehensive security auditing tool designed for Claude Code environments. It scans the entire configuration directory for security vulnerabilities, misconfigurations, injection risks, hardcoded secrets, and overly permissive settings. Ideal for initial project setup, pre-commit checks, or routine security hygiene.

Scan entire codebases or specific changes, audit repositories for security issues, and generate verified patch files. Supports scanning whole repositories, branch diffs, or individual commits. Each finding is verified by an agent panel before reporting. Suggested patches are saved as files for manual review and application. Works in auto mode for streamlined security auditing workflows.

A comprehensive guide for designing, auditing, and reporting security experiments for top-tier conferences like ACM CCS. It emphasizes moving beyond simple benchmarks by mapping every security claim to undeniable evidence, including exploit runs on named targets, overhead measurements, and evaluation against adaptive attackers. Used for rigorous academic research defense.

This guide provides rigorous standards for designing, validating, and reporting security research, particularly for high-stakes academic conferences like IEEE S&P. It covers critical areas including adaptive adversary modeling, measurement validity (sampling, ethics), statistical reporting, establishing strong baselines/ablations, and adhering to ethical constraints (IRB, authorization) to ensure evidence is robust and reproducible.

Performs a comprehensive security audit of Model Context Protocol (MCP) implementations, including servers, clients, and tools. This skill reviews code against critical security baselines (MCP-01 to MCP-05), OWASP MCP Top 10, and common Remote Code Execution (RCE) vectors (e.g., command injection, deserialization, SSRF). The output provides a detailed report with file and line references, ensuring compliance and identifying vulnerabilities before release. Use this when auditing network-exposed services or client security posture.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

A specialized skill for analyzing and reproducing complex, timing-dependent bugs in concurrent systems. Use this to investigate race windows, ordering bugs, lock gaps, stale reads, or state inconsistencies where the final outcome depends critically on request timing or asynchronous execution order. Essential for deep security auditing and debugging of distributed transactions.

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

A comprehensive framework for assessing software supply chain security. It covers generating Software Bill of Materials (SBOM), performing Software Composition Analysis (SCA) on open-source dependencies, auditing CI/CD pipelines, and analyzing container images. This skill helps identify vulnerabilities, ensure build integrity, and verify component provenance across the entire development lifecycle.

A systematic methodology for performing offensive cryptographic analysis. This skill focuses on identifying and exploiting flaws arising from the misuse of cryptographic primitives in real-world applications, rather than breaking the underlying math. Techniques covered include Padding Oracle Attacks (CBC), ECB block manipulation, Hash Length Extension, RSA weaknesses, and PRNG exploitation. Ideal for penetration testing and deep security auditing.

Runs a comprehensive security scan on a live, deployed Power Pages site. It analyzes the site's public surface for vulnerabilities, fetching the latest report and providing a plain-language summary of findings, categorized by severity. Ideal for auditing, testing, or assessing the safety of a production environment.