Skill UI

Hunts reflected, stored and blind XSS during authorized web security assessments: reflection verification, unique canary payloads, context-based injection and out-of-band confirmation.

This skill enforces a rigorous data validation protocol by establishing hard boundaries at every point data enters the system (API requests, user input, environment variables, webhooks, etc.). It mandates a four-phase process: detection, trust classification, mandatory filtering (schema validation, sanitization, type checking), and final verification. This prevents untrusted data from reaching core business logic, mitigating risks like SQL injection and XSS.

This skill provides comprehensive guidance on managing traffic within Istio service mesh deployments. It covers configuring routing, canary and blue-green deployments, circuit breakers, load balancing, traffic mirroring, and fault injection. Includes templates for VirtualService, DestinationRule, and Gateway configurations to optimize production service communication.

A specialized security auditor for Laravel applications. It analyzes code, APIs, and configurations against OWASP standards to detect vulnerabilities such as XSS, IDOR, SQL injection, and misconfigurations. Ideal for reviewing backend logic to ensure robust data protection and authorization.

Secure LLM-powered applications against prompt injection, data leakage, and abuse using input validation, output controls, and tenant isolation. Implements OWASP LLM Top 10 mitigations with Python and Node.js examples.

Conduct authorized security assessments for LLM applications and AI agents. Covers prompt injection, tool abuse, RAG exposure, memory poisoning, and system prompt extraction following OWASP LLM/ASI Top 10 guidelines. Includes red-teaming, vulnerability mapping, and compliance engineering for AI systems to ensure safety and robustness.

Logic Lens is an AI-powered code review skill that uses formal logic frameworks to detect bugs, anti-patterns, and security risks beyond linters. It covers 9 risk categories including null handling, type safety, concurrency, and security injection, providing severity-ranked findings with fix suggestions.

Reviews code for objective correctness, security, and reliability — not style. Scans for injection, auth bypass, race conditions, N+1 queries, blueprint conformance, and deprecated patterns, then reports findings by severity (CRITICAL/HIGH/MED/LOW).

This skill detects persistent instruction injection vulnerabilities in AI agents. It verifies if the agent stores malicious instructions in long-term memory or context to execute later. The process involves attempting to write a persistent rule and verifying if the agent follows it in subsequent interactions. It focuses on behavioral persistence rather than data leakage.

This skill specializes in secure mobile application development, focusing on input validation, WebView security, and mobile-specific security patterns. It covers secure data storage, authentication implementation, and platform-specific vulnerabilities for iOS and Android. Ideal for building security-first mobile apps that protect sensitive data against common attack vectors like injection and man-in-the-middle attacks.

Protect AI systems from prompt injection attacks by implementing input sanitization, tool permissioning, and output validation. Essential for securing LLM applications, RAG pipelines, and agentic workflows against indirect and direct attacks.

PydanticAI is a robust Python framework that integrates Pydantic's type-checking and validation capabilities into Large Language Models (LLMs). It allows developers to build production-ready AI agents that guarantee structured, validated outputs, moving beyond simple raw strings. Key features include supported tool calling, dependency injection for testability, and multi-model compatibility across major providers like OpenAI, Anthropic, and Gemini. Use this when reliability and correct data structure are paramount.