Skill UI

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

This skill implements a robust, multi-layered security hardening process based on the Defense-in-Depth strategy and DevSecOps principles. It coordinates specialized agents to perform comprehensive security assessments (SAST, DAST, SBOM, Threat Modeling), identify critical vulnerabilities, and execute layered remediation. The process covers application code, backend APIs, frontend components, and mobile platforms, ensuring a resilient security posture across the entire development lifecycle.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

Delivers repository-grounded AppSec threat models that map components, boundaries, assets, entry points, and attacker capabilities to abuse paths, along with prioritized mitigations tailored to codebase evidence and explicit assumptions.

Guide to automating Securitytrails workflows using Composio's toolkit via Rube MCP, covering tool discovery, connection validation, schema-compliant execution, and session handling.

A comprehensive guide to implementing expert customer data tracking across the entire stack. Includes best practices for client-side tracking using Analytics.js (React/Next.js), high-performance server-side tracking via Node.js webhooks, user identity resolution, and data governance strategies for Segment CDP.

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.