Skill UI

This tool simulates a senior application security engineer, performing a comprehensive, multi-phase audit. It checks for exposed secrets, prompt injection vectors, dependency vulnerabilities (supporting multiple languages), and critical configuration misconfigurations. It provides a scored, prioritized remediation report, ensuring a robust security posture before deployment.

The Ship command provides a comprehensive, multi-stage checklist for ensuring code readiness before production deployment. It verifies critical quality gates, including running full unit tests, performing security audits, checking for hardcoded secrets, and verifying documentation updates. Use this tool to guarantee the stability and quality of every software release.

Wire a repository through the Caveman Cloud gateway so every LLM request is measured with no behavior change. Provides step-by-step integration for OpenAI, Anthropic, Vercel AI SDK, LangChain, LiteLLM, and raw HTTP callsites, with secure secret handling and an observed verification report.

An expert advisory tool for the New Zealand Information Security Manual (NZISM). Provides comprehensive guidance for NZ government agencies, contractors, and supply chains on mandatory security compliance. Use cases include gap analysis, system classification (Unclassified to Top Secret), security risk management, and achieving GCSB/NCSC NZ accreditation.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.

Analyzes a Power Pages site project's source code and dependencies for various security issues. It runs static analysis (opengrep) and dependency scanning (trivy) to detect vulnerable packages, hard-coded secrets, license compliance problems, and general code patterns. Use this skill to audit code safety, check dependencies, or perform a comprehensive security audit.

Design, create, review, migrate, or troubleshoot Azure Developer CLI (azd) projects using current Microsoft guidance. Use for azd, azure.yaml, AZD templates, Bicep or Terraform under infra, AZD environments and secrets, hooks, deployment workflows, and azd-managed CI/CD.

Secure AI coding agents with permission boundaries, secret protection, code review gates, and safe sandbox configurations for team environments. Covers Claude Code, Cursor, Copilot, and Codex security implementations including CLAUDE.md configuration, command allowlists, filesystem access controls, and pre-commit hooks for secret scanning.

This skill provides an end-to-end pipeline for Android APK security assessments. It includes inventorying developer apps, acquiring APKs from sources like APKPure, decompiling DEX files using jadx, and searching for hardcoded secrets like API keys and internal IPs. Suitable for authorized bug bounty engagements and red team operations targeting mobile applications.

Capture and retrieve durable YYLO Ledger artifact Records with intentional profiles, payload modes, provenance, retention, and secret-safe immutable evidence.

Master secure authentication and authorization implementation using industry-standard patterns. Covers user login systems, REST/GraphQL API security, OAuth2, SSO, session management, and RBAC design. Includes guidance on token lifecycle, secrets storage, and threat modeling to protect resource access boundaries effectively.

Store, manage, and rotate secrets in AWS Secrets Manager. Supports creating secrets, retrieving values, enabling automatic rotation with Lambda, and integrating with ECS, EKS, and Lambda workloads. Includes CLI commands and Python SDK examples for secure secret handling.