Skill UI

Performs OWASP-guided security scans on PostgreSQL and MySQL databases via the database-security-scanner plugin, identifying weak passwords, SQL injection risks, and misconfigurations while generating reports and remediation advice.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

Walks through Trail of Bits’ five-step secure smart-contract workflow, running Slither and special feature checks, generating visual diagrams, documenting security properties, and flagging manual risks with an action plan.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Build security ownership graphs from git history, compute bus factor and sensitive-code risk, and export artifacts for Neo4j/Gephi while supporting queries for orphaned sensitive code and ownership clusters.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Helps product and program teams plan, assess, and steer enterprise software, SaaS, and digital transformation portfolios using quantitative risk analytics, resource optimization, health scoring, and executive-level reporting.

This central skill specializes in performing comprehensive threat modeling using STRIDE and calculating risk via DREAD scoring. It guides users through defining scope, identifying threats, and planning mitigations for new architectures. Crucially, it acts as a security router, directing specialized requests—such as pen-testing, incident response, cloud posture checks, and AI security reviews—to the appropriate dedicated skill.

This advanced tool simulates complex DeFi flash loan strategies across major protocols like Aave, dYdX, and Balancer. It calculates net profitability, estimates gas costs, and assesses comprehensive risks (MEV, liquidity, execution). Use it to evaluate arbitrage opportunities, analyze liquidation potential, or compare multiple lending providers before executing real transactions.