Skill UI

Instrument iOS apps with Frida to reverse engineer binaries, inspect Objective-C/Swift runtime flows, extract secrets, and evaluate or bypass security controls during authorized mobile penetration testing.

Use Trivy to scan Docker and OCI images for OS/library CVEs, secrets, misconfigurations, licenses, and SBOM data; integrates with CI/CD pipelines and exports SARIF/JSON/CycloneDX for policy enforcement.

Guides DevSecOps teams to harden GitHub Actions by pinning actions to SHAs, restricting GITHUB_TOKEN permissions, guarding secrets, avoiding script injection, and enforcing workflow change approvals.

Validates Helm chart provenance, scans rendered templates for misconfigurations, enforces pod security contexts, and hardens RBAC/secrets workflows so Kubernetes deployments stay compliant.

Harden serverless compute on AWS Lambda, Azure Functions, and Google Cloud Functions by enforcing least-privilege IAM roles, moving secrets into vaults, scanning dependencies, validating inputs, securing function URLs, and monitoring runtimes so injections, credential theft, and supply-chain threats are caught before deployment.

Test JWT implementations for algorithm confusion, none bypass, kid/jku injections, and weak secrets to validate authentication and privilege controls during security assessments.

Define and run penetration-test steps that hunt for exposed secrets, PII, and over-shared API responses while validating encryption and secure storage for sensitive assets.

Performs targeted security assessments of JSON Web Token implementations, probing algorithm confusion, claim tampering, brute-force secrets, and misuse during penetration tests of APIs, SSO, and microservice authentication flows.

Provides offensive security testing methodology, tooling guidance, and workflows for scanning web apps, APIs, dependencies, secrets, and infrastructure to uncover vulnerabilities before attackers exploit them.

Automates preparing private repos for safe public release through a three-stage pipeline that forks the project, scans and sanitizes secrets, and generates CLAUDE.md, setup scripts, and documentation for GitHub publication.

Guidance for Go security engineers covering injection, cryptography, filesystem, network, secrets, memory safety, and logging so audits or coding efforts stay defense-in-depth aware.

This skill performs a comprehensive security audit of Model Context Protocol (MCP) server configurations found in .mcp.json files. It is designed to identify critical vulnerabilities, including hardcoded secrets (API keys, tokens), dangerous shell injection patterns, unpinned dependencies, and compliance issues regarding approved server lists. Use this skill during security reviews, project onboarding, or pre-commit checks to ensure secure deployment.