Skill UI

This guide details how to integrate OWASP ZAP (Zed Attack Proxy) into CI/CD pipelines (GitHub Actions/GitLab) for comprehensive Dynamic Application Security Testing (DAST). It covers configuring baseline, full, and API scans to identify common vulnerabilities like XSS, SQLi, and CSRF in running web applications and REST/GraphQL APIs, ensuring security quality gates in the development lifecycle.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

Grype is an open-source vulnerability scanner by Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated Software Bill of Materials (SBOMs) to match packages against multiple databases including NVD, GitHub Advisories, and OS-specific feeds. It is ideal for security assessments, CI/CD integration, and implementing severity-based build gates.

Integrates Aqua Security's Trivy scanner into CI/CD pipelines to perform automated vulnerability scanning on Docker images and related artifacts. It detects OS package CVEs, application dependency issues, and Dockerfile misconfigurations. This ensures that only secure, compliant images can proceed to registry push or production deployment by enforcing strict quality gates.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. It covers all critical stages: unit testing (with race detection), linting, static application security testing (SAST), vulnerability scanning, automated dependency updates (Dependabot/Renovate), Docker image builds, and automated releases via GoReleaser. Ideal for DevOps engineers establishing or improving Go project quality gates.

This framework enforces high output quality, intellectual honesty, and continuous improvement across all AppSec agents. It mandates structured processes, including self-critique loops, anti-rationalization guards, and self-reflection quality gates (≥8 scoring). Applicable during code review, SAST, SCA, and threat modeling, it ensures rigorous and verifiable security analysis.

A powerful meta-skill that enforces rigorous security compliance by running three independent gates on a proposed operation: policy/governance review, secret/credential scanning, and audit log emission. It uses a strict arbitration rule (DENY > WARN > ALLOW) to provide a comprehensive safety verdict for code changes or environment manipulations. Ideal for enforcing high-security coding standards.

This skill generates a complete, actionable CI/CD playbook, thoroughly documenting the entire software deployment lifecycle. It covers essential stages like build & linting, unit/integration testing, security scanning, and phased deployment to staging and production. The output provides clear guidelines on required inputs, automated gates, manual approvals, and necessary rollback procedures, which is crucial for engineering documentation and team onboarding.

A critical security tool for detecting typosquatted, brandjacked, or misspelled packages across major registries (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and corpus matching to proactively screen dependency names before installation. Ideal for implementing CI/CD gates, auditing lockfile diffs, or reviewing dependency lists sourced from AI models to mitigate supply chain attacks.

Trivy is an open-source, comprehensive security scanner designed for DevSecOps. It assesses container images, Infrastructure-as-Code (Terraform, K8s), filesystems, and SBOMs for vulnerabilities (CVEs), misconfigurations, hardcoded secrets, and license compliance. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, ensuring that code and infrastructure are secure before deployment.

This skill performs a comprehensive, read-only, multi-agent review of a git diff or file scope. It launches four specialized sub-agents—covering Regression, Security, Performance, and Contracts—in parallel. The main agent then aggregates, filters, and summarizes critical findings, ensuring the code change is robust, secure, and maintainable. Ideal for pre-commit or Pull Request review workflows.