Skill UI

This skill provides structured guidance and patterns for performing comprehensive web fuzzing using the powerful command-line tool, ffuf. Web fuzzing is an essential security testing technique used by penetration testers to discover hidden directories, unlinked endpoints, or sensitive files on a web server by systematically brute-forcing potential paths and parameters. Use this skill when you need to audit the security posture of a web application or map out unknown parts of a website.

Performs a structured, multi-phase audit on local branch changes (diffs) to identify security vulnerabilities, bugs, and code quality issues. It systematically checks for common risks like Injection (SQL, XSS), Broken Authentication, IDOR, CSRF, and business logic flaws, providing detailed severity, evidence, and suggested fixes. Ideal for pre-merge code reviews and security audits.

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

This skill provides a structured methodology for reviewing code commits intended to fix security vulnerabilities or address audit findings. It ensures that the original root cause is properly resolved, verifies the fix hasn't introduced new bugs or vulnerabilities (regressions), and validates the overall completeness of the remediation effort. Ideal for security-critical code reviews.

This skill acts as a comprehensive security scanner specializing in detecting Cross-Site Scripting (XSS) vulnerabilities in client-side code. It performs static analysis across React, Vue, Angular, and vanilla JavaScript, specifically identifying unsafe practices like direct HTML manipulation (innerHTML), raw rendering (v-html), and insecure URL handling. Use it when auditing frontend code for security flaws and needing best practices for secure coding.

This skill provides a robust framework for implementing Role-Based Access Control (RBAC) when integrating with Gamma API in enterprise or multi-tenant environments. Since Gamma's API key is workspace-level, this solution enforces granular, per-user permissions (Guest, Viewer, Editor, Admin) at the application layer. Key components include authorization middleware, multi-tenant isolation logic, usage quota management, and detailed audit logging, ensuring system security and compliance in large-scale deployments.

This expert tool automates compliance checks for EU GDPR and German DSGVO. It scans codebases for privacy risks (PII, special data), generates formal Data Protection Impact Assessments (DPIA), and manages the entire lifecycle of Data Subject Access Requests (DSARs), ensuring adherence to strict legal deadlines. Ideal for privacy audits and compliance planning.

Claude generates comprehensive security audit reports by analyzing system and application security data, identifying vulnerabilities, checking compliance, and suggesting remediation steps via the /audit-report command.

A comprehensive, compliant wrapper for integrating with the Groq API. This module automatically sanitizes input prompts and filters model responses to redact sensitive PII (emails, phone numbers, SSN, etc.). It also tracks detailed token usage and generates robust audit logs, ensuring data privacy and regulatory compliance (GDPR, etc.) in enterprise AI applications.

A comprehensive guide for implementing and managing Role-Based Access Control (RBAC) within the Guidewire InsuranceSuite (PolicyCenter, ClaimCenter, BillingCenter). It details role hierarchies (Admin, Underwriter, Claims Adjuster), permission checking logic using APIs, and best practices for ensuring regulatory compliance (NAIC, DOI). Includes code examples for user provisioning and audit logging.

Automates HIPAA audit helper workflows within Security Advanced, offering guided best practices, production-ready configurations, and compliance validation for penetration testing and threat modeling scenarios.

Assists with auditing HTTP headers by generating best-practice guidance, production-ready configurations, and validations triggered when header security is mentioned.