Skill UI

Dep handles the entire journey from local code to production deployment. This skill automates containerization using Docker and docker-compose, establishes robust CI/CD pipelines (linting, testing, security scanning, deployment), manages environment variables and secrets, and generates Infrastructure as Code (Terraform/Pulumi) configurations. It ensures observability and provides rollback procedures.

This comprehensive guide details how to use industry-leading tools like TruffleHog and git-secrets to scan source code repositories, full git history, and configuration files for hardcoded AWS credentials and secrets. It is essential for integrating secrets detection into CI/CD pipelines, performing proactive security audits, and ensuring compliance by preventing sensitive keys from reaching production environments.

A comprehensive skill for triaging npm packages and dependency lockfiles against supply-chain threats. It utilizes heuristic scanning (GuardDog), manual tarball inspection, and dynamic detonation in isolated environments to detect malicious behavior such as credential exfiltration, reverse shell execution, and self-propagation. Essential for secure code review and CI/CD pipeline gating.

Trivy is an open-source, comprehensive security scanner designed for DevSecOps. It assesses container images, Infrastructure-as-Code (Terraform, K8s), filesystems, and SBOMs for vulnerabilities (CVEs), misconfigurations, hardcoded secrets, and license compliance. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, ensuring that code and infrastructure are secure before deployment.

This comprehensive guide outlines a multi-stage verification pipeline for Quarkus applications. It covers build artifacts, static analysis (Checkstyle, SonarQube, PMD), comprehensive testing (Unit, Integration, API), security scanning (OWASP, dependency checks), native compilation, and performance testing (K6). Use this before PRs or deployments to ensure code quality and stability.

A comprehensive, multi-stage skill designed to simulate a professional Continuous Integration (CI) pipeline. It guides users through critical quality gates, including build verification, type checking, linting, running test suites (with coverage checks), security scanning for secrets, and final diff review. Use this skill before creating a Pull Request or finalizing any significant feature to ensure code robustness and adherence to best practices.

A comprehensive security auditing tool designed to analyze codebases for vulnerabilities. It provides a structured workflow to scan entire repositories, review specific changes (like PR diffs or single commits), and suggest verified patch files. Findings are challenged by independent agents, ensuring that suggested fixes are targeted and require manual review before application.

An autonomous system designed to continuously improve code quality by scanning codebase metrics. It functions as an agent, proposing mechanical code changes, executing them, and committing only if defined metrics improve. It supports multiple modes (Scan, Scaffold, Run) for systematic, data-driven codebase refactoring.