Skill UI

This skill provides robust mechanisms to verify the integrity of AI agent plugins, tools, and dependencies. It generates deterministic SHA-256 manifests (INTEGRITY.json) for all components, allowing users to detect unauthorized modifications, track provenance, and ensure that deployed assets match their published versions. Use this during CI/CD pipelines, code review, and pre-production promotion to secure the entire agent ecosystem.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.

This comprehensive guide serves as a quick reference for diagnosing and fixing common Flexport API v2 errors. It covers standard HTTP status codes (e.g., 401, 403, 422, 429, 5xx), detailing the causes and providing actionable fixes, including cURL examples and validation best practices. Essential for developers integrating supply chain solutions with Flexport.

This skill provides instructions for deploying Flexport logistics integrations across various cloud platforms, including Vercel, Fly.io, and Google Cloud Run. It is essential for setting up reliable, always-on webhook receivers, shipment tracking dashboards, and background workers necessary for comprehensive supply chain automation services in a production environment.

Implements robust webhook event handling for Flexport, enabling real-time tracking and processing of critical logistics updates. It manages shipment milestones (e.g., departed, arrived, delivered), booking confirmations, PO changes, and invoice events. Includes signature verification (HMAC-SHA256) and idempotent processing to ensure reliable supply chain data integration.

This workflow manages critical logistics documentation via the Flexport API, including creating commercial invoices for customs clearance, maintaining detailed product catalogs (SKUs, HS codes, costs), and retrieving freight invoices. It is essential for integrating customs documentation, product data management, and billing reconciliation into your supply chain systems.

A comprehensive reference architecture for building robust and scalable supply chain integrations with Flexport's logistics API. It outlines a structured pipeline using Ingest (webhooks/polling), Core (business logic services), and Expose (REST API/Dashboard layers), ensuring reliable data flow, caching, and queueing best practices.

This guide provides comprehensive security standards for integrating with the Flexport API. It covers critical best practices such as webhook signature verification, secure API key rotation, implementing least-privilege access controls, and data redaction for handling sensitive logistics and customs data. Essential for maintaining compliance and preventing data breaches in supply chain operations.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

An expert playbook for identifying and simulating dependency confusion attacks in software supply chains. It comprehensively covers how internal package names can be squatted on public registries, leading to malicious code execution via package manager lifecycle hooks (e.g., npm, pip, Maven). Use this guide for authorized red-team exercises and deep vulnerability assessment of build processes.

This skill runs the Bumblebee scanner on macOS/Linux to perform read-only inventory and exposure checks. It detects compromised packages, developer tools, and host configurations against known security advisories. It is primarily used for supply-chain incident response and vulnerability assessment, providing developers with a clear picture of local system exposure.

This skill provides deep security review for GitHub Actions workflow files. It focuses on the unique Actions threat model—identifying vulnerabilities like script injection via ${{ }} interpolation, privilege escalation from triggers (e.g., pull_request_target), and ensuring least-privilege permissions for CI/CD pipelines. Use it to audit, secure, or harden existing workflows, preventing attacks from untrusted inputs and supply chain risks.