Skill UI

This skill guides the implementation of Gitleaks for robust secret scanning across development lifecycles. It covers setting up pre-commit hooks to prevent secrets from being committed, integrating scanning into CI/CD pipelines (like GitHub Actions), and writing custom regex rules to detect and remediate hardcoded credentials (API keys, passwords, tokens) in Git history, ensuring adherence to secure SDLC practices.

A comprehensive guide to deploying HashiCorp Vault for centralized secrets management. Learn how to handle dynamic secret generation for databases and cloud providers, manage PKI, and integrate securely with Kubernetes. This solution is critical for eliminating hardcoded credentials from application code and CI/CD pipelines, enforcing zero-trust principles, and migrating to short-lived, auto-rotated secrets.

This skill guides the integration of gitleaks and trufflehog into CI/CD pipelines. It automates the detection of hardcoded secrets, such as API keys, passwords, and tokens, preventing their accidental deployment. By integrating scans as a mandatory pre-deployment gate, organizations enforce strong security policies and maintain compliance.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

This skill provides a systematic cryptographic audit tool designed to review applications for security vulnerabilities. It scans source code and configuration files to detect weak hashing algorithms (MD5, SHA-1), insecure cipher modes (ECB), hardcoded secrets, and deprecated protocols like TLS 1.0. Essential for security assessments, compliance checks, and maintaining secure coding practices.

A comprehensive tool designed for assessing the security posture of Programmable Logic Controller (PLC) firmware. It specializes in detecting critical vulnerabilities such as hardcoded credentials, undocumented debug interfaces, backdoor functions, and memory corruption flaws. The tool supports analyzing major industrial platforms (Siemens, Allen-Bradley) by performing static and dynamic analysis, and verifying firmware integrity against known-good baselines, adhering to standards like IEC 62443. Use only in authorized lab environments.

This sophisticated tool automates the security review of serverless functions across major cloud providers, including AWS Lambda, Azure Functions, and GCP Cloud Functions. It systematically identifies critical misconfigurations such as overly permissive IAM execution roles (wildcard actions), hardcoded secrets in environment variables, and potential lack of runtime protections. Ideal for pre-production auditing and compliance checks.

A comprehensive guide to conducting security assessments on thick client (desktop) applications. This skill details techniques ranging from static analysis (using tools like dnSpy, IDA Pro) to dynamic analysis (process monitoring with Procmon, network interception via Burp Suite). It covers finding hardcoded credentials, identifying insecure local storage, mitigating DLL hijacking, and analyzing memory manipulation within local applications.

A comprehensive guide for reversing and analyzing .NET malware samples. Learn the full workflow, including identifying .NET assemblies, using de4dot to deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and loading the cleaned code into dnSpy. This skill is essential for extracting hardcoded C2 configurations, encryption keys, and credentials, and debugging runtime behaviors of complex malware.

A comprehensive 7-stage workflow designed to manage, audit, and optimize GitHub repositories. This tool automates critical tasks including identifying hardcoded secrets, cleaning up junk files, performing deep documentation reviews, benchmarking against competitors, and validating the final state, transforming messy codebases into production-ready assets.

Audit MCP server configurations for security issues including hardcoded secrets, shell injection patterns, mutable package references, and unapproved servers. Use this skill when reviewing .mcp.json files, onboarding new MCP servers, or conducting security reviews of agent tool configurations.