Skill UI

A specialized workflow guide for comprehensive security testing of REST and GraphQL APIs. It systematically covers critical security aspects such as authentication validation (OAuth2, JWT), authorization checks (IDOR, privilege escalation), input validation (SQL/NoSQL injection), rate limiting enforcement, and secure error handling. Ideal for vulnerability assessment, bug bounty programs, and pre-deployment security audits.

Scans Cairo/StarkNet smart contracts for six critical issues spanning felt252 arithmetic, messaging, access control, and signature replay, reporting severity and fixes to support audits, bridge reviews, and pre-launch security checks.

Scans Cosmos SDK chains and CosmWasm contracts for nine consensus-critical vulnerabilities such as non-determinism, incorrect GetSigners, and ABCI panics, returning findings and fix guidance when auditing or preparing new launches.

This skill functions as a specialized dependency security expert. It analyzes project dependencies to identify critical security vulnerabilities, licensing compliance issues, and outdated packages. It provides comprehensive, actionable remediation strategies to strengthen supply chain security.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

A specialized skill for conducting comprehensive security audits, including SAST scans, penetration testing, and dependency analysis. It identifies vulnerabilities across code, infrastructure, and cloud environments, generating structured reports with severity ratings (CVSS) and actionable remediation guidance. Essential for DevSecOps and compliance.

A comprehensive toolkit for professional security engineers. It covers the entire security lifecycle, including systematic threat modeling using STRIDE, designing secure architectures based on Zero Trust and Defense-in-Depth, conducting detailed vulnerability assessments (SAST/DAST), and implementing secure coding practices. Ideal for security audits, compliance reviews, and building resilient systems.

Scans Substrate/Polkadot FRAME pallets for seven critical vulnerabilities such as arithmetic overflow, panic DoS, incorrect weights, unsigned validation issues, bad randomness, and origin flaws, making it ideal for runtime audits and pre-launch security assessments.

Scans FunC-based TON smart contracts for boolean, Jetton, and gas handling vulnerabilities, reporting critical issues with file references and offering remediation guidance for auditors and secure dApp launches.

Provides Windsurf projects with dependency tree analysis, vulnerability scanning, and update planning, helping developers audit npm/yarn/pnpm/pip packages, plot safe migrations, and apply verified upgrades.

This skill performs deep, architectural context building by conducting ultra-granular, line-by-line analysis of code. It applies advanced reasoning techniques like First Principles, 5 Whys, and 5 Hows to map system invariants, data flows, and assumptions across entire call chains (including external black-box calls). It is designed to establish a complete, stable mental model of the system's logic before any vulnerability or bug hunting begins, ensuring bottom-up understanding.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.