Skill UI

Use Trivy to automate comprehensive vulnerability detection (CVEs, misconfigurations) in Docker container images within CI/CD pipelines. This skill guides users on establishing robust quality gates—such as integrating into GitHub Actions or GitLab CI—to ensure that only secure images are pushed to production registries, covering OS packages, dependencies, and Dockerfile best practices.

Trivy is a comprehensive open-source vulnerability scanner used for detecting vulnerabilities, misconfigurations, secrets, and license violations across OS packages, language dependencies, and container images. It integrates seamlessly into CI/CD pipelines for robust security testing and compliance.

This skill guides the implementation of comprehensive security controls for container registries. It details workflows for vulnerability scanning using Trivy and Grype, generating Software Bill of Materials (SBOMs) with Syft, and enforcing image authenticity using Cosign and Sigstore. It is essential for building robust CI/CD pipelines and preventing supply chain attacks by ensuring only scanned, signed, and compliant images are deployed.

A specialized skill for generating production-ready, SEO-optimized visual assets. It handles various use cases including OG social cards, blog hero images, product visuals, and infographics. The system ensures outputs adhere to best practices like specific aspect ratios, schema markup, and file naming conventions, making content publishable and discoverable by search engines.

AKF is the native metadata format specifically designed for tracking AI-generated or AI-modified content. It allows users to stamp files (including DOCX, PDF, images, and code) with detailed trust scores, source provenance, and compliance metadata. This tool is essential for professional workflows requiring strict auditing, compliance assurance, and verifiable data lineage, especially concerning regulations like the EU AI Act, HIPAA, and SOX.

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

Fetches Feishu cloud document content as Lark-flavored Markdown, extracts media tokens, and guides invoking feishu_doc_media to download images, files, and whiteboards while handling wiki token resolution.

This skill guides developers on integrating Firebase AI (Gemini) into Flutter applications. It covers essential topics including initial setup and configuration, generating text and managing multi-turn chat responses, implementing real-time streaming output, handling multimodal prompts (text and images), and ensuring robust error handling, security, and adherence to data privacy best practices.

This skill provides comprehensive functionality for reading, creating, editing, and downloading content from Lark Feishu Docs (Docx/Wiki). Whether accessing via URL or token, it supports structured content manipulation using both XML and Markdown formats (v2 API). Use it for fetching document details, updating specific blocks, and managing embedded media and resources like whiteboards and images. Note that it requires prerequisite knowledge for advanced operations.

This guide details the functionalities for interacting with Lark Instant Messaging (IM). It covers core concepts like message types, threads, reactions, and flags, and provides methods for managing chat history, creating/managing groups, and handling various message resources (images, files, videos). It is essential for applications needing robust chat communication capabilities.

Generates professional PowerPoint decks by planning slide structure, crafting AI images for each slide, and composing them into a consistent, visually rich presentation file.

Handles user prompts to send local files or images by emitting the required Weixin protocol block so the app can deliver them directly; report success only when the block and target file exist to avoid false claims.