Skill UI

Automates comprehensive security scanning by integrating SAST (Semgrep), DAST (OWASP ZAP), SCA (Trivy), and secrets detection (Gitleaks) into CI/CD pipelines. This solution helps organizations shift security left, detect vulnerabilities early, and meet strict compliance mandates such as SOC 2, PCI-DSS, and ISO 27001.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

This library provides a complete and verified set of grep command patterns designed for auditing existing React codebases. It is essential for developers preparing for major React upgrades, specifically migration audits for React 18.3.1 or React 19. It detects deprecated APIs, removed features, unsafe lifecycle methods, batching vulnerabilities, and dependency conflicts, ensuring a smooth transition.

A comprehensive guide and workflow for managing a personal knowledge vault using Obsidian. It details best practices for structuring notes in a flat file system, utilizing index notes, and leveraging wikilinking syntax ([[wikilinks]]) for robust connectivity. Includes command-line methods (grep/find) for efficient searching, note creation, and finding related backlinks across the entire vault, ensuring organized, interconnected learning.

A fast, grep-based linter that checks for common design system violations in CSS and component code, such as hardcoded colors, raw pixel values, and deprecated syntax. It provides immediate automated feedback to ensure code adheres to established design tokens and best practices.

This skill provides comprehensive command-line interface (CLI) support for OpenViking, enabling agents to manage external resources, perform filesystem operations, and execute data tasks. It covers adding resources, importing/exporting data, browsing directories, reading/writing files, and advanced searching (find, grep, search). Use cases include data pipeline setup, knowledge graph manipulation, and system maintenance.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

Analyzes a Power Pages site project's source code and dependencies for various security issues. It runs static analysis (opengrep) and dependency scanning (trivy) to detect vulnerable packages, hard-coded secrets, license compliance problems, and general code patterns. Use this skill to audit code safety, check dependencies, or perform a comprehensive security audit.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

An expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverages AI tools like GitHub Copilot, Qodo, GPT-5, and Claude with platforms like SonarQube, CodeQL, and Semgrep to identify bugs, vulnerabilities, and performance issues in code across 30+ languages.

Expert AI-powered code review combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverages tools like GitHub Copilot, SonarQube, CodeQL, and Semgrep to identify bugs, vulnerabilities, and performance issues across 30+ languages, integrated with CI/CD pipelines for instant PR feedback.