Skill UI

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

Checks AI agent implementations against the OWASP Agentic Security Initiative Top 10 risks, producing findings on controls, vulnerabilities, and recommendations for prompt injection, tool governance, escalation, logging, identity, policy, supply chain, and behavioral monitoring before production or audit.

This skill provides the OWASP Top 10 for Agentic Applications 2026 (ASI) framework for classifying security risks in AI agent systems. It maps detection findings to standardized risk categories like goal hijacking, tool misuse, and identity abuse, enabling consistent security assessment and remediation prioritization for agentic workflows.

An automated framework for continuous, repeatable red-teaming of LLM applications within CI/CD pipelines. It integrates Promptfoo and DeepTeam to test against recognized vulnerabilities like OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS (e.g., Prompt Injection, Jailbreaks). This ensures that security vulnerabilities do not regress after code or model changes, providing a critical merge-blocking security gate for production LLM apps.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

A specialized downstream skill for analyzing security vulnerabilities in complex agentic systems. This tool is designed for red teaming and penetration testing, focusing on detecting prompt injection, retrieval poisoning, memory contamination, planner drift, and tool boundary abuse within multi-step LLM chains. Use when proving how untrusted inputs compromise system integrity.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

This skill detects supply chain compromise risks in AI agents. It identifies vulnerabilities related to compromised dependencies, malicious plugins, tools, models, and untrusted update sources. It is used when agents dynamically load external resources or pull remote configurations. The skill probes for untrusted loading, dependency integrity, and malicious artifact injection to ensure agent security.