Skill UI

A comprehensive toolkit for professional security engineers. It covers the entire security lifecycle, including systematic threat modeling using STRIDE, designing secure architectures based on Zero Trust and Defense-in-Depth, conducting detailed vulnerability assessments (SAST/DAST), and implementing secure coding practices. Ideal for security audits, compliance reviews, and building resilient systems.

Session Security Guide supplies automated, production-ready assistance for session security checker tasks, offering best practice guidance on authentication, validation, secure coding, and vulnerability detection.

This comprehensive guide outlines the best practices and structured methodology for developing specialized skills for AI coding agents. It provides detailed instructions on integrating Azure SDKs and Microsoft Foundry services, covering crucial topics like secure authentication patterns (DefaultAzureCredential), modular workflow design, and maintaining concise, effective knowledge context for optimal agent performance.

Auto-activating security assistant that steps through SQL injection detector tasks, enforces best practices on authentication, input validation, and secure coding, and produces validated code/configuration for Security Fundamentals scenarios.

This policy set establishes comprehensive guardrails for using AI coding assistants (like Windsurf/Cascade). It governs terminal commands, enforces workspace isolation (preventing access to secrets/credentials), and integrates CI/CD gates for code quality. Use this when setting up team development standards, mandatory code review policies for AI output, or implementing secure development pipelines.

This comprehensive guide covers essential security patterns for Perl development, addressing common vulnerabilities like SQL Injection, XSS, Path Traversal, and Shell Injection. It details best practices including using Perl's Taint Mode, implementing strict allow-list validation, performing safe file operations, and executing external commands securely to ensure robust and resilient applications.

This skill provides a systematic cryptographic audit tool designed to review applications for security vulnerabilities. It scans source code and configuration files to detect weak hashing algorithms (MD5, SHA-1), insecure cipher modes (ECB), hardcoded secrets, and deprecated protocols like TLS 1.0. Essential for security assessments, compliance checks, and maintaining secure coding practices.

This comprehensive guide details security-first development practices, emphasizing threat modeling (STRIDE) and secure design principles. It provides mandatory controls for validating all external input, preventing common vulnerabilities like XSS and SQL injection, and properly managing authentication and sensitive data storage. Use it when building any feature that handles untrusted data or interacts with external systems.

This comprehensive guide outlines best practices for writing high-quality, scalable, and maintainable code in .NET/C#. It covers core architectural principles, including SOLID, dependency injection, and design patterns (e.g., Command Handler). Furthermore, it addresses modern challenges such as structured logging, async/await patterns, secure coding, robust testing standards, and advanced AI integration using Semantic Kernel.

Automated guardrails for enforcing security policies and coding standards across all Figma API integrations. This tool is essential for CI/CD pipelines, helping to prevent credential leaks (PATs), validate API scopes, enforce request best practices, and ensure stable, secure connectivity with Figma.

A powerful PreToolUse hook designed to act as a safety net during code writing sessions. It automatically scans both file paths and content for 12 common security anti-patterns, including SQL injection, XSS, command injection (Node.js/Python), and unsafe deserialization. It blocks the writing operation and provides immediate warnings, ensuring adherence to secure coding practices when handling sensitive code like authentication or payment logic.