Skill UI

Provides market intelligence for Brazilian real-estate auctions, covering liquidity, typical discounts, exit strategies (flip/renovation/rental), ROI, and benchmarks such as Selic, CDI, and FII.

Index of 37 advanced engineering agent skills for Claude Code, Codex, Gemini CLI and Cursor, covering agent design, RAG, MCP servers, CI/CD, database design, observability, security auditing, release automation and platform reliability operations.

A comprehensive guide to using k6 for robust performance and load testing across APIs, WebSockets, and browser scenarios. Learn to write realistic load simulations (smoke, load, stress, soak), analyze performance metrics, set SLAs, and integrate testing into CI/CD pipelines to ensure system reliability before deployment.

Opinionated Terraform workflow skill that guides module design, state/backend management, provider patterns, security hardening, policy-as-code checks, and CI/CD plan/apply flows so IaC stays modular, compliant, and reliable.

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.

A comprehensive guide detailing how to integrate DevSecOps best practices into a GitLab CI/CD pipeline. It automates multiple security checks, including Static Analysis (SAST), Dynamic Analysis (DAST), container scanning, dependency scanning, and secret detection. This approach enforces 'shift-left' security, finding and fixing vulnerabilities early in the development lifecycle to ensure compliance and robust security.

DefectDojo is an open-source platform for comprehensive vulnerability management. It aggregates findings from over 200 security scanners (e.g., Nessus, ZAP), automatically deduplicates results, and provides detailed dashboards for tracking remediation progress. It integrates seamlessly with CI/CD pipelines, Jira for ticketing, and Slack for notifications, making it ideal for automated security reporting and compliance tracking in a DevSecOps environment.

A comprehensive solution for identifying and preventing the accidental commitment of exposed AWS credentials, API keys, and session tokens within source code, configuration files, and git history. It integrates TruffleHog and git-secrets into CI/CD pipelines and pre-commit hooks, providing critical protection against credential theft and unauthorized cloud access in a DevSecOps environment. Essential for security auditing and compliance.

A robust security auditing tool designed to scan CI/CD pipeline configurations, such as GitHub Actions YAML, for critical supply chain vulnerabilities. It automatically detects issues like unpinned dependencies, script injection risks, secrets exposure, and dependency confusion, helping teams harden their build systems and maintain secure software development lifecycles.

Details techniques for exploiting misconfigured Kerberos Constrained Delegation (KCD) in Active Directory. By abusing the S4U2Self and S4U2Proxy protocols, attackers can impersonate highly privileged users (e.g., Domain Admins) to achieve lateral movement or full domain compromise during authorized red-team engagements.

A detailed guide for conducting authorized penetration tests to detect and exploit HTTP request smuggling flaws. This technique targets discrepancies in Content-Length and Transfer-Encoding parsing between front-end proxies (like CDNs or load balancers) and back-end servers, allowing attackers to bypass security controls and hijack subsequent requests.

This skill detects command-and-control (C2) traffic hidden using domain fronting techniques. It analyzes proxy and web gateway logs by comparing discrepancies between the TLS SNI field and the HTTP Host header. By inspecting these mismatches and correlating them with known CDN provider properties, it helps security analysts hunt for sophisticated network evasion tactics.