Skill UI

An expert developer specializing in secure backend coding practices, vulnerability mitigation, and robust API design. Proficient in preventing common attacks such as SQL injection, XSS, and CSRF. Covers comprehensive areas including input validation, authentication mechanisms (OAuth 2.0, MFA), database security, and implementing necessary security headers (CSP, HSTS) for building secure-by-design applications. Ideal for implementing security fixes or building new, hardened backend services.

This comprehensive guide outlines essential, production-grade security best practices for implementing Clerk authentication. It covers securing environment variables, hardening middleware with crucial security headers (like CSP, X-Frame-Options), protecting API routes with granular authorization checks, and verifying webhooks using signature validation (svix). Use this when deploying or auditing an application to ensure maximum security posture.

Automatically assists with generating Content Security Policies, offering step-by-step guidance, production-ready code, and validation against common standards whenever you mention or ask about CSP generation.

An expert skill dedicated to building secure, robust frontend applications. It specializes in preventing client-side vulnerabilities such as XSS and clickjacking. Core capabilities include safe DOM manipulation, implementing Content Security Policy (CSP), advanced input sanitization (allowlisting), and securing complex interactions like secure redirects and session management.

This skill guides users through implementing comprehensive security measures for Vercel deployments. It covers best practices for secret management (using sensitive environment variables), configuring critical HTTP security headers (such as CSP and HSTS), protecting preview environments, and enforcing robust access control for API routes and deployment tokens.

Guides security architects through designing and deploying a continuous CSPM program across AWS, Azure, and GCP, covering tool selection, policy baselines, automation, and SOC integration to monitor misconfigurations and prioritize remediation.

Guides building a two-tier OpenSSL-based certificate authority hierarchy with Python cryptography, covering root and intermediate CA creation, certificate issuance, CRL/OCSP configuration, and policy enforcement for secure deployments.

Deploys AWS Security Hub as a centralized CSPM to aggregate GuardDuty, Inspector, Macie, and partner findings, enforce CIS/AWS/PCI standards, and drive automated remediation plus compliance reporting across multi-account AWS estates.

Blueprint for implementing cloud security posture management across AWS, Azure, and GCP using native services plus Prowler and ScoutSuite scans, automated daily pipelines, and unified aggregation to surface misconfigurations and compliance drift.

Implements multi-cloud CSPM by wiring AWS Security Hub, Azure Defender for Cloud, and tools like Prowler and ScoutSuite to detect misconfigurations and posture risks.

Step-by-step guidance for auditing HTTP security headers—CSP, HSTS, frame protection, cookie flags, and other browser controls—to spot missing or misconfigured protections during authorized assessments, CI/CD checks, or compliance reviews.

A comprehensive skill for identifying and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It systematically tests reflected, stored, and DOM-based contexts by injecting various JavaScript payloads. The process involves mapping all user input points, identifying output contexts (HTML body, attribute, JS string, etc.), and crafting payloads to bypass sanitization and Content Security Policy (CSP) protections, simulating real-world attacks like session hijacking and credential theft.