Skill UI

A comprehensive CI/CD quality gate checklist for Spring Boot projects. It guides developers through mandatory steps including building, static analysis (SpotBugs, PMD), running unit/integration tests, measuring code coverage, performing security scans (OWASP), and reviewing diffs before merging or deploying.

A comprehensive, multi-stage skill designed to simulate a professional Continuous Integration (CI) pipeline. It guides users through critical quality gates, including build verification, type checking, linting, running test suites (with coverage checks), security scanning for secrets, and final diff review. Use this skill before creating a Pull Request or finalizing any significant feature to ensure code robustness and adherence to best practices.

A comprehensive guide for positioning research papers for top-tier security conferences like USENIX Security. It covers defining coverage against 'Big-Four' and specialty venues, ensuring novelty across multi-cycle academic pipelines, identifying mechanism-level differentiators, and mastering double-blind citation mechanics for maximum impact.

This comprehensive guide details the academic submission lifecycle for USENIX Security. It maps out the multi-stage review pipeline, from initial submission through early rejection to final notification. It critically updates authors on the current decision vocabulary (e.g., Shepherd Approval, retired major revisions), emphasizing mandatory review foci like ethics adequacy, threat-model realism, and openness posture for strategic planning.

This advanced skill specializes in tracing the complete provenance of software artifacts across the entire development lifecycle. It is designed for deep security analysis of CI/CD pipelines, identifying dependency drift, build tampering, package origin, and determining the final artifact consumed at runtime. Use it when investigating integrity vulnerabilities in complex release flows.

Orchestrates a robust, multi-stage cyber defense pipeline using specialized AI agents to analyze raw log files (e.g., nginx, auth, syslog). The system ingests logs, detects anomalies, classifies overall risk, and generates a comprehensive, actionable incident report, making it ideal for security investigations and breach analysis.

Performs comprehensive, two-layer validation on generated plans. Layer 1 executes instant structural checks (format, dependencies, compliance) while Layer 2 triggers specialist agents (e.g., security, DB, performance) based on plan content. The system forces resolution of all identified issues before allowing execution, supporting auto-fixes and guided human input.

A comprehensive framework for assessing software supply chain security. It covers generating Software Bill of Materials (SBOM), performing Software Composition Analysis (SCA) on open-source dependencies, auditing CI/CD pipelines, and analyzing container images. This skill helps identify vulnerabilities, ensure build integrity, and verify component provenance across the entire development lifecycle.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

This expert skill advises critical infrastructure owners and operators (pipelines, railroads, public transit) on complying with complex TSA cybersecurity directives. It provides deep knowledge of CRMP, CIP, CAP, IT/OT segmentation, and incident reporting protocols. Use it for gap assessments, policy drafting, and security architecture reviews related to transportation critical systems.

Comprehensive guidelines for DevOps workflows including infrastructure design, CI/CD pipelines, container management with Docker and Kubernetes, health checks, rollback strategies, feature flags, and mobile release processes. Ensures production readiness and security compliance across various environments.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations like Claude Code and OpenAI Codex. Detects attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines through static analysis.