Skill UI

This skill provides a comprehensive security hardening checklist for reviewing scoped architectures. It covers network security, authentication, API safety, data protection, secrets management, supply chain dependencies, and incident response protocols. It ensures compliance with standards like GDPR, PCI-DSS, and HIPAA where applicable. Use this to validate controls against evidence-based practices before production deployment.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

This skill creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. It guides users through a strict workflow including test-first development, AST analysis, and validation. Ideal for building static analysis detections, enforcing coding standards, and identifying data flow issues using taint mode.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks. Provides static analysis and manual review workflow.

A comprehensive five-phase methodology for bug bounty and SRC vulnerability hunting, covering intake, reconnaissance, enumeration, active hunting, and reporting. Includes attack playbooks for SQLi, XSS, RCE, SSRF, IDOR, and more, with WAF bypass techniques and prioritization strategies for efficient security assessments.

This skill handles tasks involving Supabase, a backend-as-a-service platform. It covers database management, authentication, edge functions, storage, and real-time features. It includes guidance on client library integration with frameworks like Next.js and React. The skill emphasizes verifying changes against documentation, securing data with Row Level Security (RLS), and managing API keys safely. It helps resolve auth issues and implement secure database policies.

This skill performs external reconnaissance on software supply chain attack surfaces. It identifies public GitHub organizations, internal package names in JS/Python bundles, and Docker images. It checks for dependency confusion vulnerabilities by verifying if internal package names are available on public registries. Requires explicit authorization for offensive security assessments.

This skill identifies dependencies at heightened risk of exploitation or takeover by evaluating factors like maintainer activity, popularity, and security history. It generates a security report for supply chain attack surface assessment and pre-engagement scoping.

This skill enables comprehensive software supply chain security assessment, covering SBOM generation, SCA scanning, CI/CD pipeline review, and container image auditing. It involves verifying build integrity, dependency provenance, and vulnerability reachability. Key activities include auditing upstream repositories, integrating security gates in CI/CD, ensuring artifact integrity, and monitoring CVEs for actual exploitability to mitigate supply chain attacks.

This skill maps identified security threats to appropriate controls and mitigation strategies. It is essential for prioritizing security investments, building comprehensive remediation roadmaps, validating existing control coverage, and performing detailed risk treatment planning. It helps organizations design robust, defense-in-depth security architectures.