Skill UI

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

This skill implements a robust, multi-layered security hardening process based on the Defense-in-Depth strategy and DevSecOps principles. It coordinates specialized agents to perform comprehensive security assessments (SAST, DAST, SBOM, Threat Modeling), identify critical vulnerabilities, and execute layered remediation. The process covers application code, backend APIs, frontend components, and mobile platforms, ensuring a resilient security posture across the entire development lifecycle.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Provides a Senior SecOps engineer toolkit for running SAST/DAST, dependency CVE scans, policy checks, and compliance automation (SOC2/PCI-DSS/HIPAA/GDPR) during audits, CVE response, or CI/CD hardening.

A comprehensive guide detailing how to integrate DevSecOps best practices into a GitLab CI/CD pipeline. It automates multiple security checks, including Static Analysis (SAST), Dynamic Analysis (DAST), container scanning, dependency scanning, and secret detection. This approach enforces 'shift-left' security, finding and fixing vulnerabilities early in the development lifecycle to ensure compliance and robust security.

Implements API Security Posture Management (API-SPM) to continuously discover, classify, and risk-score all APIs (internal, external, partner, shadow). It aggregates security findings from DAST, SAST, SCA, and runtime monitoring to provide a unified, continuous view of API risk and compliance across the enterprise.

Automates comprehensive security scanning by integrating SAST (Semgrep), DAST (OWASP ZAP), SCA (Trivy), and secrets detection (Gitleaks) into CI/CD pipelines. This solution helps organizations shift security left, detect vulnerabilities early, and meet strict compliance mandates such as SOC 2, PCI-DSS, and ISO 27001.

Utilizes GitHub Advanced Security (GHAS) and CodeQL to implement comprehensive SAST across enterprise repositories. This solution automates static analysis, detecting vulnerabilities (e.g., SQL injection, XSS) and secrets at scale, enabling true 'shift-left' security by integrating checks directly into pull request workflows and CI/CD pipelines.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

This tool provides a structured methodology for triaging web application security findings generated by DAST and SAST scanners (e.g., Burp Suite, ZAP). It validates true positives, dismisses false positives, and assigns risk ratings using the OWASP Risk Rating Methodology (Risk = Likelihood x Impact). Use it to reduce alert fatigue and prioritize remediation efforts for development teams, ensuring focus on the most critical vulnerabilities.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. It covers all critical stages: unit testing (with race detection), linting, static application security testing (SAST), vulnerability scanning, automated dependency updates (Dependabot/Renovate), Docker image builds, and automated releases via GoReleaser. Ideal for DevOps engineers establishing or improving Go project quality gates.