Skill UI

A comprehensive security auditing tool for AI agent skills. It combines deterministic static scanning (SkillSpector) with deep semantic analysis to assess safety, trustworthiness, and potential risks. Determines if a skill is safe to install by checking for over-permissions, malicious behavior, and hidden dependencies.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This skill enables authorized reverse engineering of Chrome and Firefox browser extensions. It involves analyzing manifest files, background workers, and content scripts to investigate credential handling, data exposure, and malicious behavior. Suitable for security audits, supply chain poisoning investigations, and understanding extension logic through static and dynamic analysis using tools like DevTools and Frida.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

This skill combines automated static analysis and AI tools like GitHub Copilot and SonarQube to identify bugs, vulnerabilities, and performance issues in code. It supports multi-language reviews, integrates with CI/CD pipelines, and provides actionable recommendations for security, architecture, and maintainability across various development workflows.

This skill focuses on reversing JavaScript-based custom DSL and Virtual Machine interpreters, commonly found in risk-control and captcha engines. It involves identifying IIFE and switch-based opcode dispatch patterns, extracting opcode tables, and capturing runtime semantics. The workflow includes static analysis for variable mapping and opcode classification, as well as runtime injection techniques to understand exported functions. It excludes standard WASM and typical Webpack bundles.

This skill acts as a frontend security specialist to detect Cross-Site Scripting (XSS) vulnerabilities in React, Vue, Angular, and vanilla JavaScript code. It performs static analysis to identify unsafe DOM manipulation, improper sanitization, and injection points. The tool helps developers secure client-side applications by highlighting dangerous patterns like innerHTML usage, URL injection risks, and framework-specific security issues such as dangerouslySetInnerHTML or v-html directives. It provides severity ratings and remediation suggestions for CWE-79 vulnerabilities.

Enables deep static analysis of compiled binaries (PE/ELF/Mach-O) using IDA Pro via MCP automation. Supports decompilation, disassembly, data-flow tracking, and cross-references. Includes scripts for server management and file handling to bypass common MCP schema issues and handle system file permissions.

End-to-end iOS security assessment pipeline covering app inventory, IPA acquisition, static analysis, and secret extraction. Requires explicit authorization for offensive testing and bug bounty scopes.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Provides structured phases for static and dynamic analysis, IOC extraction, YARA rule creation, and reporting.

This skill acts as an expert AI-powered code review specialist combining automated static analysis and intelligent pattern recognition. It leverages tools like GitHub Copilot, SonarQube, and CodeQL to identify bugs, vulnerabilities, and performance issues across 30+ languages. It supports CI/CD integration, security vulnerability analysis, architectural coherence checks, and actionable recommendations for maintainability and testability within modern DevOps workflows.

This skill enables expert-level reverse engineering of software binaries. It covers disassembly, decompilation, and analysis using tools like IDA Pro, Ghidra, and radare2. Suitable for security research, CTF challenges, and malware analysis. It includes methodologies for static and dynamic analysis, helping users understand binary structures, identify vulnerabilities, and document findings ethically.