Skill UI

This tool acts as a centralized orchestrator for the entire Go development lifecycle. It analyzes the current task context—whether designing an API, debugging a panic, or building a gRPC service—and intelligently loads multiple, highly relevant skills simultaneously. It ensures developers have comprehensive, context-aware support for complex workflows, handling everything from architecture and error management to performance tuning and security auditing.

A powerful meta-skill that enforces rigorous security compliance by running three independent gates on a proposed operation: policy/governance review, secret/credential scanning, and audit log emission. It uses a strict arbitration rule (DENY > WARN > ALLOW) to provide a comprehensive safety verdict for code changes or environment manipulations. Ideal for enforcing high-security coding standards.

This skill maps engineering changes (code diffs, architecture designs, IaC) to specific financial compliance controls, such as PCI-DSS v4.0 and MAS TRM. It generates an auditable report detailing compliance gaps, required evidence, and concrete remediation steps, helping teams catch violations before formal audits.

This skill provides deep security review for GitHub Actions workflow files. It focuses on the unique Actions threat model—identifying vulnerabilities like script injection via ${{ }} interpolation, privilege escalation from triggers (e.g., pull_request_target), and ensuring least-privilege permissions for CI/CD pipelines. Use it to audit, secure, or harden existing workflows, preventing attacks from untrusted inputs and supply chain risks.

This skill performs a comprehensive audit of project dependencies, identifying critical security vulnerabilities (CVEs), analyzing license compliance against established policies, and detecting outdated or risky packages. It produces an actionable report including an overall dependency health score and a prioritized, time-bound remediation plan, ensuring the software supply chain is secure and legally compliant.

This tool conducts structured reviews of various Infrastructure-as-Code (IaC) tools (e.g., Terraform, Pulumi) across multiple cloud providers. It generates an actionable report that categorizes findings by severity (Critical, High, Medium, Low), providing detailed remediation steps and a reusable best-practice checklist for continuous security, compliance, and operational auditing.

An adversarial Quality Assurance (QA) pass designed to deep-dive into any codebase for logic errors, security flaws, and functional bugs. Instead of confirming that code 'looks right,' this skill actively attempts to break the code by simulating hostile inputs, tracing critical data paths, and checking for subtle, real-world correctness issues. Essential for high-stakes, critical code reviews.

A comprehensive, pre-deployment, defense-in-depth security audit tool for Solidity smart contracts built with Foundry. It combines static analysis (Slither, Aderyn), symbolic execution (Mythril), property-based fuzz testing, and key hygiene checks to proactively detect critical vulnerabilities like reentrancy, access control flaws, and arithmetic bugs before deployment to any EVM chain.

This comprehensive guide details how to use industry-leading tools like TruffleHog and git-secrets to scan source code repositories, full git history, and configuration files for hardcoded AWS credentials and secrets. It is essential for integrating secrets detection into CI/CD pipelines, performing proactive security audits, and ensuring compliance by preventing sensitive keys from reaching production environments.

A critical security tool for detecting typosquatted, brandjacked, or misspelled packages across major registries (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and corpus matching to proactively screen dependency names before installation. Ideal for implementing CI/CD gates, auditing lockfile diffs, or reviewing dependency lists sourced from AI models to mitigate supply chain attacks.

This skill performs an adversarial audit of web application authentication flows. It systematically probes for critical security vulnerabilities such as missing CSRF protection, insecure session cookies (lacking Secure/HttpOnly flags), risky cross-origin redirects, and OAuth misconfigurations. It generates a structured report detailing findings and severity levels, making it ideal for pre-deployment security audits and regression testing.

This utility manages scheduled, persistent background workers using the `CronCreate` mechanism. Unlike simple in-session loops, scheduled cron jobs survive system restarts, making them ideal for Continuous Integration (CI), system monitoring, and scheduled maintenance tasks (e.g., security audits, performance optimization, data consolidation). Users can define various recurring schedules and understand the difference between persistent cron scheduling and active session looping.