Skill UI

A comprehensive guide for securing container images and runtime environments. Covers best practices from Dockerfile authoring (minimal base images, multi-stage builds, non-root users) through advanced runtime enforcement (seccomp, AppArmor) and Kubernetes security controls. Essential for production hardening and maintaining supply chain integrity.

Dep handles the entire journey from local code to production deployment. This skill automates containerization using Docker and docker-compose, establishes robust CI/CD pipelines (linting, testing, security scanning, deployment), manages environment variables and secrets, and generates Infrastructure as Code (Terraform/Pulumi) configurations. It ensures observability and provides rollback procedures.

This skill generates a complete React component structure following the industry-standard Container/Presentation pattern. It automatically scaffolds necessary files, including TypeScript, Storybook, and SCSS styles, ensuring adherence to project conventions. Use this when building new, scalable components, allowing you to properly classify whether the component is UI-focused (Presentation) or logic-heavy (Container).

This skill automates the entire phishing incident response workflow using the Splunk SOAR REST API. It parses suspicious emails, creates incident containers, attaches artifacts (URLs, IPs, headers), triggers automated investigation playbooks, and compiles a comprehensive security verdict. It is designed for security operations teams building robust, automated incident response capabilities.

A comprehensive workflow and deep technical guide for analyzing malicious Linux ELF binaries. Covers static analysis (reading ELF headers, checking entropy, identifying strings), dynamic tracing (monitoring system calls and library usage with strace/ltrace), and reverse engineering (using GDB) of threats like ransomware, botnets, and rootkits targeting Linux servers and containers (x86_64, ARM).

Install and run kube-bench to audit Kubernetes against the CIS Benchmark. Supports standalone, container, Job, or DaemonSet modes; auto-selects benchmark version and scans control plane, etcd, kubelet, nodes, and policies. Outputs text, JSON, JUnit, or ASFF for CI pipelines and compliance.

Deploy and operate Falco with the modern eBPF driver in Kubernetes and Docker. Covers driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Ideal for enabling runtime security, routing alerts to SIEM or Falcosidekick, and upgrading existing deployments.

Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.

This comprehensive guide covers the process of creating, analyzing, and securing Software Bills of Materials (SBOMs). It utilizes Syft to generate standards-compliant SBOMs (CycloneDX or SPDX) from container images and filesystems. The workflow details correlating these SBOMs with known CVEs using Grype for vulnerability analysis, and subsequently signing the artifacts with Cosign. This process is crucial for establishing supply chain trust, ensuring dependency visibility, and integrating vulnerability gating into CI/CD pipelines.

Trivy is an open-source, comprehensive security scanner designed for DevSecOps. It assesses container images, Infrastructure-as-Code (Terraform, K8s), filesystems, and SBOMs for vulnerabilities (CVEs), misconfigurations, hardcoded secrets, and license compliance. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, ensuring that code and infrastructure are secure before deployment.

Opens a named, traced browser session bound to an RVF cognitive container, recording every action as a ruvector trajectory step. It is the primitive that browser extraction, form-fill and testing skills compose on, enabling session replay and analysis.

This guide provides comprehensive testing patterns for C# and .NET applications. It covers best practices using xUnit, FluentAssertions, and advanced techniques like mocking (NSubstitute/Moq), parameterized testing, and full integration testing using Testcontainers and WebApplicationFactory. Ideal for improving test quality, coverage, and developing robust, maintainable codebases.