Skill UI

Perform static application security testing to identify vulnerabilities in source code before deployment. Use tools like Semgrep, CodeQL, and SonarQube to integrate security gates into CI/CD pipelines and ensure compliance with secure SDLC practices.

This skill performs Static Application Security Testing (SAST) to detect code vulnerabilities across multiple programming languages and frameworks. It helps identify injection flaws, hardcoded secrets, and security policy violations before deployment. Suitable for code reviews, compliance checks like OWASP, and legacy code assessment. Requires source code access and is not for runtime testing.

Provision and manage AWS cloud infrastructure using Terraform Infrastructure as Code (IaC). Create reusable modules, manage state files, and implement best practices for declarative resource deployment. Suitable for DevOps workflows requiring automated server, network, and storage setup.

Generate production-ready Terraform modules for AWS, Azure, and GCP. Standardize cloud resource provisioning, implement infrastructure as code best practices, and ensure multi-cloud compatibility for scalable infrastructure management.

This skill audits and refines source code comments across languages, defaulting to no comment unless it preserves meaningful non-obvious information. It helps maintainers understand codebases by removing low-value commentary like obvious flow or restatements, keeping only essential rationale, constraints, and tradeoffs that cannot be inferred from the code itself.

This skill automates the creation of comprehensive unit tests across multiple programming languages like Python, JavaScript, and Java. It analyzes source code to identify functions and classes, then generates maintainable test suites with strong coverage, edge case handling, and proper mocking. Ideal for developers seeking consistent test structures and improved code quality without manual writing.

Unship is a dedicated local workflow for front-end developers to compare multiple AI-generated UI alternatives (such as layouts, copy, or flows) directly within a running application environment. Instead of committing to one generated version, it adds temporary source-level variants, allowing for visual comparison. After the user selects the final version, the skill automatically cleans up all unused temporary code and attributes, ensuring a clean, production-ready codebase. Note: This tool is for local iteration only, not for production A/B testing or analytics.

LWC is a durable memory system for coding agents that preserves project decisions, code structure, and verified context across sessions. It utilizes a physical Wiki document graph and a CodeGraph index to enable source-grounded recall. This tool helps agents search, update, and maintain knowledge without losing critical information during future coding-agent interactions.

Answer repository questions grounded entirely in source code evidence. Searches and reads relevant files, then synthesizes answers with inline citations. Useful for understanding specific files, functions, or components, and for answering how or where questions about the codebase.

Detects missing zeroization of sensitive data in C/C++/Rust source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis and control-flow verification. Use for auditing code that handles secrets, keys, passwords, or other sensitive data.

Investigate shipped apps, binaries, packages, and runtimes with evidence-backed reverse engineering. Trace features, compare versions, decompile, or guide reconstruction. Skip ordinary complete source-code analysis.