Skill UI

Configure AWS CloudTrail to enable organization-wide audit logging for compliance and security investigation. This skill covers setting up S3 buckets for log storage, applying security policies, enabling encryption, and creating trails for multi-region activity. It includes configuring event selectors for management and data events, and setting up CloudWatch alarms for unauthorized API calls to meet standards like SOC 2 or HIPAA.

Automate the rotation of sensitive credentials, including RDS database passwords, API keys, and OAuth tokens, using AWS Secrets Manager and Lambda. This skill ensures secure credential lifecycle management, helping maintain system security and compliance by automatically updating credentials for various AWS and third-party services.

This Java SDK enables secure storage and management of secrets such as passwords, API keys, and connection strings within Azure Key Vault. It supports operations like creating, retrieving, updating, listing, deleting, recovering, and purging secrets, as well as backup and restore functionalities for sensitive configuration data.

Expert backend architect for scalable API design, microservices, distributed systems, resilience, security, and observability.

This skill empowers you to implement secure backend coding practices, focusing on input validation, authentication, and API security. It covers vulnerability prevention, defensive programming, and secure architecture implementation. Ideal for building security-first applications that resist common attack vectors like SQL injection, XSS, and CSRF. Includes expertise in database protection, secret management, and HTTP security headers.

This skill ensures code adheres to security best practices and identifies vulnerabilities. It is used for authentication, authorization, input validation, file uploads, and API development. It covers secrets management, SQL injection prevention, XSS protection, and secure session handling.

This skill audits deployed web apps for exposed secrets like hardcoded API keys and tokens in JavaScript or HTML. It checks for publicly reachable config files and security header misconfigurations. It is a defensive, read-only workflow for authorized security reviews to identify potential data leaks without exploiting systems.

Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review, validation, and structured reporting. Use for security reviews, pen-testing, and vulnerability hunting in web apps, APIs, services, CLI tools, libraries, and daemons.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

CRED-OMEGA serves as an enterprise operational CISO engine for comprehensive credential and secret management. It integrates with AI coding tools to secure API keys and vaults. Use this skill for specialized security tasks involving credential governance, secret handling, and enterprise security compliance. Avoid for general assistance or when simpler tools are available.

Perform dynamic application security testing against running web apps using OWASP ZAP, Burp Suite, Nikto, Nuclei, and Arachni. Automate baseline, full, and API scans in CI/CD to find runtime vulnerabilities.

Master building high-performance asynchronous APIs using FastAPI, SQLAlchemy 2.0, and Pydantic V2. Covers microservices, WebSockets, security, testing, and deployment strategies for production-ready Python backend systems. Includes async patterns, database optimization, and observability.