Skill UI

This skill guides the integration of OWASP ZAP for Dynamic Application Security Testing (DAST) directly into CI/CD pipelines. Learn how to perform baseline, full, and API scans against running applications, interpret complex security findings, tune scan policies, and establish automated security quality gates in modern CI/CD platforms like GitHub Actions and GitLab CI. Essential for DevSecOps practices.

This skill guides developers through integrating Static Application Security Testing (SAST) tools like CodeQL and Semgrep into GitHub Actions CI/CD pipelines. It covers automating code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results, and establishing quality gates to prevent vulnerable code from merging into production.

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

This skill provides comprehensive guidance on hardening GitHub Actions CI/CD pipelines against modern supply chain attacks, credential theft, and privilege escalation. It teaches best practices such as pinning actions to immutable SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection from untrusted inputs, and implementing required approval gates for critical deployments.

A comprehensive guide to designing scalable, cost-effective, and compliant architectures on Microsoft Azure. This skill covers the entire lifecycle, from gathering detailed business requirements (SLA, RPO/RTO) and selecting appropriate service patterns (AKS, Serverless, Data Factory), to generating Infrastructure as Code (IaC) using Bicep. It also includes steps for cost optimization, reserved instance planning, and setting up robust CI/CD pipelines via Azure DevOps or GitHub Actions.

Design and implement a unified operational workflow for managing notifications sourced from disparate tools like GitHub, Linear, local hooks, and chat platforms. This skill addresses notification fragmentation, alert noise, and redundancy by establishing clear severity levels, ownership, routing channels, and next operational actions into a single, cohesive pipeline.

A comprehensive guide for setting up production-grade CI/CD pipelines for Go projects using GitHub Actions. This skill covers essential quality gates including unit testing, linting (golangci-lint), static analysis security testing (SAST), vulnerability scanning, dependency management, Docker builds, and automated releases using GoReleaser.

Use the gh CLI to inspect PRs, issues, workflow runs, and logs while querying GitHub resources via the API or structured JSON filters.

Comprehensive Go testing guidance that spans table-driven subtests, testify suites, mocking, unit/integration tests, benchmarks, coverage, fuzzing, goleak leak detection, snapshot checks, and GitHub Actions CI to keep production suites reliable.

This comprehensive guide provides detailed procedural steps for configuring and executing CodeQL code scanning. It covers both implementing automated workflows using GitHub Actions (`codeql.yml`) and running scans via the CodeQL CLI. Users will learn how to manage language matrices, set build modes, interpret SARIF outputs, handle monorepo structures, and troubleshoot complex security analysis setups across multiple languages (e.g., Python, Java, C++).

This skill is designed to retrieve and display detailed usage metrics for GitHub Copilot within organizations and enterprises. Users can analyze adoption rates, total suggestions, acceptance rates, and chat interactions, broken down either by the entire organization/enterprise or on a per-user basis. It supports querying data for specific historical dates using GitHub CLI and REST API.

Generates a concise, AI-optimized specification describing what an existing GitHub Actions workflow does, its triggers, requirements, inputs/outputs, and governance so teams can understand and maintain it without implementation details.