Skill UI

This skill details how to configure CodeRabbit review behavior using a `.coderabbit.yaml` file placed on base branches. It enables setting tailored code quality gates across the development lifecycle, allowing for relaxed reviews on feature branches and highly stringent, security-focused checks for production or release environments, ensuring quality matches risk.

This skill automatically generates comprehensive and highly structured Pull Request (PR) descriptions directly from Git diffs. It goes beyond simple summaries by automatically adding detailed change categories (e.g., source, test, config), security risk assessments, and required review checklists based on the modified file types. Use this when submitting complex code changes or when the diff is large and requires explicit structure for thorough review.

Creates step-by-step decomposition plans and migration roadmaps to guide the transition from monolithic applications to distributed architectures, prioritizing risk, value, and dependencies while tracking progress through pattern-based phases.

Provides ISO 27001 ISMS audit and certification guidance, covering program planning, risk-based execution, Annex A control assessment, finding management, and Stage 1/Stage 2 documentation support for compliance teams.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

A rigorous, security-focused code review process designed for Pull Requests (PRs), commits, and diffs. It moves beyond general reviews by focusing intensely on high-risk areas such as authentication, cryptography, external calls, and value transfer. The methodology is evidence-based, requiring detailed attack scenario modeling and generating comprehensive, auditable markdown reports to identify overlooked vulnerabilities and regressions.

Leverages Monte Carlo-based simulation to spot potential software vulnerabilities by feeding randomized inputs into modules, tracking failure likelihoods, and highlighting risky code paths for security testing.

This skill outlines a comprehensive, structured workflow for managing Microsoft Patch Tuesday security updates. It covers the entire lifecycle, from initial vulnerability triage and risk assessment to testing, staged deployment (Pilot, Production Rings), and final validation, ensuring compliance with risk-based remediation SLAs.

This skill analyzes Azure AD/Microsoft Entra ID environments to detect illicit OAuth application consent grants. It leverages the Microsoft Graph API and directory audit logs to enumerate permissions, identify overly broad scopes, and flag high-risk applications based on publisher verification status. It is essential for SOC analysts and threat hunters investigating cloud identity security incidents.

This skill provides a structured framework for implementing patch management in Operational Technology (OT) and Industrial Control Systems (ICS) environments. It addresses the critical balance between cybersecurity remediation and maintaining continuous operational safety and availability. Key components include risk-based patch prioritization, vendor compatibility testing, staged deployment through test environments, managing maintenance windows, and implementing compensating controls for unpatchable assets.

A comprehensive guide to securing Kubernetes Role-Based Access Control (RBAC). It teaches best practices for implementing least-privilege policies, eliminating excessive cluster-admin bindings, utilizing namespace-scoped roles, and integrating external identity providers (OIDC) to mitigate risks like privilege escalation and unauthorized data access.

This skill maps observed adversary behaviors, security alerts, and detection rules to the MITRE ATT&CK framework. It is essential for quantifying detection coverage, building ATT&CK heatmaps, tagging SIEM alerts, and prioritizing security controls based on known threat actor playbooks. Use it for comprehensive gap analysis and risk reporting.