Skill UI

Provides Windsurf projects with dependency tree analysis, vulnerability scanning, and update planning, helping developers audit npm/yarn/pnpm/pip packages, plot safe migrations, and apply verified upgrades.

Guides Windsurf Enterprise teams through preparing identity providers, configuring SAML/OIDC, managing certificates and policies, and validating the setup so enterprise deployments get secure, audited single sign-on.

Explains how to store Windsurf API keys safely, rotate secrets, enforce least-privilege scopes, validate webhooks, and log audits so teams can secure Windsurf integrations across dev/staging/prod environments.

Provides Wycheproof test vectors for validating cryptographic implementations against known attacks and edge cases, making it ideal for CI regression sweeps and third-party crypto audits.

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Systematically examines project dependencies, using GitHub data to highlight single-maintainer, unmaintained, unpopular, or otherwise risky packages before audits so teams can focus security efforts and propose better-maintained alternatives.

Detects missing zeroization of secrets and flags compiler-optimized removals with mandatory assembly/IR evidence, helping auditors verify C/C++/Rust cryptographic code through dataflow, CFG, and runtime validation.

Vibe Code Auditor assesses prototype-quality or AI-generated implementations for structural flaws, maintainability issues, and hidden production risks, surfacing concise remediation steps to harden fragile code before long-term maintenance or handoff.

Automatically scans modern API frameworks (Next.js, Express, FastAPI, Django) to generate comprehensive, ready-to-run test suites. It ensures complete coverage for critical areas including authentication, input validation (boundary/injection), error code matrices, pagination, file uploads, and rate limiting. Ideal for TDD, contract testing, and security audits.

This powerful tool helps translate natural language requirements into robust, normalized relational database schemas. It can generate comprehensive schema designs, complete with relationships, constraints, and advanced architectural concerns like multi-tenancy, soft deletes, and audit trails. Furthermore, it automates the generation of database migrations (supporting Prisma, TypeORM, Alembic, etc.), corresponding type definitions (TypeScript/Python), seed data, and Entity-Relationship Diagrams (ERD) using Mermaid.

Guides static reviews of GitHub Actions workflows that invoke AI coding agents, teaching how to find workflow files, trace composite actions, capture security-relevant settings, and detect attacker-controlled data paths to agents in CI/CD pipelines.

Guides Claude into ultra-granular, line-by-line analysis before hunting vulnerabilities, enforcing first principles, 5 Whys/Hows, and explicit mental models to map invariants, assumptions, and flows across functions and external calls for secure architecture reviews.