Skill UI

Centralizes pipeline health checks, forecast accuracy tracking, and go-to-market efficiency measurement for SaaS revenue teams, generating text or JSON outputs via CLI scripts to monitor coverage, MAPE, GTM metrics, and risk flags before leadership reviews.

Apply a rigorous coding standard by explicitly stating assumptions, avoiding unsupported claims, and covering both happy and unhappy paths before writing or reviewing code to ensure reliability.

Expert skill for writing, reviewing, and debugging idiomatic Rust code, focusing on memory safety and zero-cost abstractions. Specializes in advanced concepts like ownership patterns, explicit lifetime management, trait-based API design, and building concurrent async applications using Tokio. Use this when developing high-performance, reliable, systems-level software in Rust.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

Runs external LLM CLIs (OpenAI Codex or Google Gemini) to review uncommitted changes, branch diffs, or specific commits, providing an independent second opinion before merges or releases.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

A comprehensive toolkit for professional security engineers. It covers the entire security lifecycle, including systematic threat modeling using STRIDE, designing secure architectures based on Zero Trust and Defense-in-Depth, conducting detailed vulnerability assessments (SAST/DAST), and implementing secure coding practices. Ideal for security audits, compliance reviews, and building resilient systems.

A specialized methodology for reviewing APIs, configuration schemas, and interfaces to identify 'footguns'—design choices where the path of least resistance leads to insecurity. This analysis focuses on making secure usage the default, covering topics like dangerous defaults, primitive vs. semantic type safety, and insecure algorithm selection. It is crucial for architects and reviewers to prevent developer misuse at the design level.

Scans Solana and Anchor programs for six critical security vulnerabilities—arbitrary CPI, improper PDA validation, missing signer/ownership checks, sysvar spoofing, and instruction introspection issues—to support audits and pre-launch reviews.

Checklist covering Spring Security best practices for authentication, authorization, validation, CSRF, secrets, headers, rate limiting, dependency scans, and logging in Java Spring Boot services.