Skill UI

Provides comprehensive guidance for setting up and configuring Static Application Security Testing (SAST) tools, including Semgrep, SonarQube, and CodeQL. Learn how to integrate security scanning into CI/CD pipelines, define custom security rules, enforce quality gates, and manage compliance policies to proactively identify and remediate code vulnerabilities across multiple programming languages.

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

This skill generates a comprehensive, minimal, and enforceable security policy document (Blue Book) for applications handling sensitive data. It structures requirements using MUST/SHOULD/CAN language, explicitly defining assumptions, scope, threat models, and security gates. It is essential for establishing clear security guardrails and ensuring compliance early in the development lifecycle.

A comprehensive meta-skill for validating, testing, and scoring the quality of technical skills within an ecosystem. It performs deep structural checks (SKILL.md compliance), executes Python scripts for syntax, runtime, and output validation, and generates multi-dimensional quality scores using letter grades and tier recommendations. Ideal for new skill authorship, auditing existing components, or integrating rigorous QA gates into CI/CD pipelines.

Structured pre-PR verification loop for Spring Boot projects that runs fast-build checks, static analysis, tests with coverage, security scans, formatting gates, and diff reviews to catch issues before deployment.

A comprehensive tool for tracking and analyzing cryptocurrency derivatives markets. It aggregates key metrics such as funding rates, open interest, liquidations, and options flow across major CEX and DEX exchanges. Use it to identify arbitrage opportunities, gauge market sentiment, predict trend strength, and perform deep risk analysis on perpetual swaps and futures contracts.

This skill guides the integration of Windsurf workflows into CI/CD pipelines (like GitHub Actions). It provides comprehensive mechanisms for validating configuration files and enforcing AI code quality standards. Use it to automate policy checks, detect hardcoded secrets, ensure sufficient test coverage for new files, and manage complex config deployments across repositories, ensuring highly reliable and compliant code merges.

This policy set establishes comprehensive guardrails for using AI coding assistants (like Windsurf/Cascade). It governs terminal commands, enforces workspace isolation (preventing access to secrets/credentials), and integrates CI/CD gates for code quality. Use this when setting up team development standards, mandatory code review policies for AI output, or implementing secure development pipelines.

This guide outlines critical reliability patterns for integrating advanced AI coding assistants into professional development workflows. It emphasizes best practices such as mandatory Git checkpointing, utilizing dedicated feature branches, breaking large tasks into incremental steps, and implementing comprehensive validation gates (linting, testing). Use this when developing fault-tolerant, AI-assisted applications to prevent accidental code breaks and maintain project stability.

This skill provides guidance for implementing tasks using structured workflow patterns, specifically following Conductor's TDD (Test-Driven Development) workflow. It helps manage phase checkpoints, organize git commits, and execute rigorous verification protocols. Use it when adhering to a defined development plan, ensuring quality gates are passed, and managing the entire lifecycle from initial planning to final validation.

A comprehensive guide covering patterns and architectures for automating code execution using LLMs. It spans simple sequential pipelines (e.g., daily dev scripts) to advanced, RFC-driven multi-agent Directed Acyclic Graph (DAG) orchestration. Ideal for building CI/CD style continuous development pipelines, managing complex state, and automating quality gates without human intervention.

This pattern defines a robust, continuous loop structure for autonomous agents. It integrates crucial components like quality gates, evaluation harnesses, and explicit recovery controls. It guides complex workflows by defining decision paths (e.g., PR control, RFC decomposition) and includes strategies to mitigate common failure modes such as infinite loop churn or cost drift, ensuring measurable progress in autonomous systems.