Skill UI

Provides language- and framework-specific security best practices guidance by loading reference documents, detecting vulnerabilities, and generating prioritized reports when asked.

This skill generates a comprehensive, minimal, and enforceable security policy document (Blue Book) for applications handling sensitive data. It structures requirements using MUST/SHOULD/CAN language, explicitly defining assumptions, scope, threat models, and security gates. It is essential for establishing clear security guardrails and ensuring compliance early in the development lifecycle.

This expert simulates a compliance expert, specializing in regulatory requirements for software systems, including GDPR, HIPAA, SOC2, and PCI-DSS. It performs comprehensive audits, identifies compliance gaps, and generates actionable implementation plans, technical controls, and policy templates to ensure adherence to industry standards.

Guides AWS users through generating secure security group configurations with best practices, automating code and configuration creation plus validation across compute, storage, and networking scenarios.

Comprehensive checklist for application security hardening, covering input validation, output encoding, SQL/CSRF defenses, security headers, JWT best practices, secrets handling, rate limiting, and dependency audits to keep web services resilient.

Automates the creation and validation of security headers by guiding users through authentication, input validation, secure coding, and vulnerability detection practices within the Security Fundamentals domain.

Build security ownership graphs from git history, compute bus factor and sensitive-code risk, and export artifacts for Neo4j/Gephi while supporting queries for orphaned sensitive code and ownership clusters.

Provides authentication, authorization, encryption, secrets, and hardening patterns for designing secure auth flows, managing tokens, configuring CORS, and implementing best practices around API keys, JWT, OAuth, and rate limiting.

Automates security policy creation within Security Advanced workflows by offering step-by-step guidance, best-practice templates, and validation of outputs for compliance, penetration testing, and threat modeling use cases.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.