Skill UI

A comprehensive guide detailing security best practices for integrating with Lokalise. Covers strategies for managing API token scopes (read-only vs. read-write), enforcing the principle of least privilege, validating translated content for XSS or credential leakage, verifying webhook secrets, and securing CI/CD pipelines against hardcoded secrets. Essential for developers and DevOps engineers.

This comprehensive guide provides templates for integrating MaintainX API testing into automated CI/CD pipelines. It covers multiple stages, including unit tests (mocked), live integration tests against staging environments, and security scans (like gitleaks). Use this when setting up robust, automated quality gates for your MaintainX SaaS integrations.

A comprehensive specialist that combines automated static analysis (SonarQube, CodeQL, Semgrep) with advanced AI capabilities. This tool performs multi-layered code reviews assessing security vulnerabilities, performance bottlenecks, architectural coherence, and maintainability across various programming languages, integrating seamlessly into CI/CD pipelines.

Provides comprehensive guidance for setting up and configuring Static Application Security Testing (SAST) tools, including Semgrep, SonarQube, and CodeQL. Learn how to integrate security scanning into CI/CD pipelines, define custom security rules, enforce quality gates, and manage compliance policies to proactively identify and remediate code vulnerabilities across multiple programming languages.

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

A comprehensive, multi-phase workflow designed for Infrastructure as Code (IaC) using Terraform. It guides users through provisioning cloud resources, creating reusable modules, managing complex state, handling multi-environment deployments, and integrating robust CI/CD pipelines and security practices. Ideal for establishing scalable, repeatable, and auditable cloud infrastructure.

Provides Terraform and OpenTofu best-practice guidance for module design, testing selection, CI/CD pipeline setup, security scanning, and architecture decisions in production infrastructure-as-code projects.

A comprehensive guide for implementing secure and reliable webhook endpoints to handle Vercel deployment lifecycle events. This skill covers signature verification (HMAC) to ensure security, processing key events (e.g., deployment.ready, deployment.error), and implementing idempotency to prevent duplicate actions. Ideal for building automated CI/CD integrations, status notifications, or custom project hooks that react to deployment changes in real-time.

This skill provides AI-assisted capabilities for creating and managing Continuous Integration/Continuous Deployment (CI/CD) workflows using GitHub Actions. It can generate new workflows from project requirements, optimize existing pipelines, debug failures, and implement industry-standard security best practices, streamlining the entire development and deployment process.

Automatically monitors YAML workflows to validate syntax, infer schemas, convert formats, and harden Kubernetes/Docker Compose/CI configurations while spotting anti-patterns and security gaps.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.