Skill UI

This skill provides comprehensive guidance on selecting the optimal workspace architecture for Windsurf, adapting to various project scales. Whether managing small solo projects, large monorepos, or complex multi-service, polyglot systems, it outlines strategies for structuring file systems and configuring rules. The goal is to ensure that AI tools receive accurate and focused project context, maximizing developer efficiency.

This skill provides a structured workflow for porting existing Semgrep security rules to multiple target languages. It guides users through applicability analysis, test-first rule creation, and validation for each language variant, ensuring consistent and accurate security coverage across polyglot codebases.

This guide provides a comprehensive, step-by-step process to scaffold a modern Spring Boot application using Kotlin. It covers downloading the template, configuring dependencies (including SpringDoc and ArchUnit), and setting up complex polyglot environments using Docker Compose. Supports PostgreSQL, MongoDB, Redis, and WebFlux reactive programming.

An advanced, AI-powered agent designed to generate comprehensive and workable unit tests for virtually any programming language (e.g., Python, C#, Java, Go, TypeScript). It operates via a sophisticated multi-agent pipeline (Research → Plan → Implement → Build → Test → Fix → Lint). This ensures generated tests are not only written following project conventions but also compile, pass all tests, and effectively improve code coverage.

Aspire is a code-first polyglot toolchain that orchestrates containers, executables, and cloud resources through an AppHost project, guiding creation, debugging, configuration, deployment, and troubleshooting for distributed applications across languages.

This skill provides a comprehensive checklist and methodology for identifying Server-Side Template Injection (SSTI) vulnerabilities. It covers template engine identification (e.g., Jinja2, Twig), polyglot payload generation, systematic detection methods, and executing engine-specific Remote Code Execution (RCE) payloads. Ideal for security professionals testing web application input sanitization.

A comprehensive checklist and methodology for testing Cross-Site Scripting (XSS) vulnerabilities. Covers all major types, including Stored, Reflected, DOM, and Blind XSS, along with advanced techniques like CSP bypass, polyglot payloads, and event handler injection. Essential for web application security testing and bug bounty hunting to identify and mitigate malicious script injection risks.

This expert playbook provides comprehensive techniques for exploiting Server-Side Template Injection (SSTI). It covers polyglot detection probes, engine fingerprinting (Jinja2, Twig, FreeMarker, etc.), sandbox escape mechanisms (MRO chains), and advanced bypass techniques. Essential reading for security researchers and penetration testers assessing application vulnerabilities.

A comprehensive playbook for digital forensic experts. It details systematic techniques and tools for detecting and extracting hidden data embedded across various media types, including images (LSB, PNG chunks, JPEG DCT, EXIF metadata), audio (spectrogram, DTMF), and files (polyglots, appended data). Essential for deep-dive forensic investigations.