Skill UI

End-to-end workflow for fixing GitHub issues: understand the issue, research prior art, plan, create a branch, implement, test, and open a PR using the gh CLI. Includes prompt-injection safeguards for untrusted issue content.

Performs a comprehensive security audit of Model Context Protocol (MCP) implementations, including servers, clients, and tools. This skill reviews code against critical security baselines (MCP-01 to MCP-05), OWASP MCP Top 10, and common Remote Code Execution (RCE) vectors (e.g., command injection, deserialization, SSRF). The output provides a detailed report with file and line references, ensuring compliance and identifying vulnerabilities before release. Use this when auditing network-exposed services or client security posture.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

A specialized downstream skill for CTF-sandbox workflows. Used to analyze complex security challenges driven by AI agent interactions, prompt injection, or infrastructure vulnerabilities. Focuses on tracing control chains involving untrusted input, tool side effects, deployment drift, container runtime issues, and CI/CD supply chain provenance. Ideal for rigorous vulnerability assessment in modern, distributed systems.

A specialized downstream skill for analyzing security vulnerabilities in complex agentic systems. This tool is designed for red teaming and penetration testing, focusing on detecting prompt injection, retrieval poisoning, memory contamination, planner drift, and tool boundary abuse within multi-step LLM chains. Use when proving how untrusted inputs compromise system integrity.

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

This tool performs a rapid, heuristic security assessment focused on identifying common vulnerabilities listed in the OWASP Top 10. It scans source code for hardcoded secrets, SQL injection risks, XSS vectors, insecure dependencies, and authentication flaws. It is ideal for pre-commit checks or code reviews before merging sensitive changes.

This tool simulates a senior application security engineer, performing a comprehensive, multi-phase audit. It checks for exposed secrets, prompt injection vectors, dependency vulnerabilities (supporting multiple languages), and critical configuration misconfigurations. It provides a scored, prioritized remediation report, ensuring a robust security posture before deployment.

A comprehensive, multi-phase security scanner designed to audit development environments (Claude Code setup). It checks MCP servers, installed skills, agents, and hooks against known threat databases, malicious patterns, and supply chain vulnerabilities. Key checks include CVE screening, prompt injection detection, and unauthorized network access patterns.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

This skill provides an active penetration testing toolchain covering information gathering, port scanning, vulnerability scanning, web attacks (SQL injection, XSS), directory brute-forcing, and password cracking. It exposes 20+ security tools to AI agents via MCP servers for authorized security assessments.

This skill audits the security and integrity of legal AI components, including skills, prompts, workflows, and tools. It proactively detects prompt injection, malicious code, data exfiltration paths, and supply-chain risks before deployment or trust. Essential for maintaining confidentiality, privilege, and adhering to legal standards in AI environments.