Skill UI

Harden serverless compute on AWS Lambda, Azure Functions, and Google Cloud Functions by enforcing least-privilege IAM roles, moving secrets into vaults, scanning dependencies, validating inputs, securing function URLs, and monitoring runtimes so injections, credential theft, and supply-chain threats are caught before deployment.

Guides pen testers through hunting for exposed API keys, PII, secrets, and insecure transmissions in web apps by combining targeted scans, response analysis, and TLS checks to validate data protection.

Assesses JWT implementations during authorized penetration tests by decoding tokens, probing none/algorithm-confusion attacks, brute-forcing HMAC secrets, and manipulating claims to uncover authentication bypass or privilege escalation risks.

Manages production-grade secret infrastructure, covering Vault clusters, cloud secret stores, auth methods, rotation, and audit patterns to harden DevOps pipelines and respond to leaks.

Provides offensive security testing methodology, tooling guidance, and workflows for scanning web apps, APIs, dependencies, secrets, and infrastructure to uncover vulnerabilities before attackers exploit them.

Automates preparing private repos for safe public release through a three-stage pipeline that forks the project, scans and sanitizes secrets, and generates CLAUDE.md, setup scripts, and documentation for GitHub publication.

Executes training, fine-tuning, inference, and batch jobs on Modal’s zero-config GPU cloud so you just write Python, run `modal run`, and let Modal auto scale, manage secrets, and halt billing when finishes.

Guidance for Go security engineers covering injection, cryptography, filesystem, network, secrets, memory safety, and logging so audits or coding efforts stay defense-in-depth aware.

This skill performs a comprehensive security audit of Model Context Protocol (MCP) server configurations found in .mcp.json files. It is designed to identify critical vulnerabilities, including hardcoded secrets (API keys, tokens), dangerous shell injection patterns, unpinned dependencies, and compliance issues regarding approved server lists. Use this skill during security reviews, project onboarding, or pre-commit checks to ensure secure deployment.