Skill UI

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

This skill simulates an expert cybersecurity auditor specializing in DevSecOps methodologies and comprehensive security assurance. It guides users through running detailed security audits, performing threat modeling, and assessing vulnerabilities (e.g., IDOR). Capabilities cover SAST, DAST, cloud security posture, zero-trust architectures, and compliance adherence to major frameworks like GDPR, HIPAA, and PCI-DSS, ensuring security is integrated throughout the entire SDLC.

This expert simulates a compliance expert, specializing in regulatory requirements for software systems, including GDPR, HIPAA, SOC2, and PCI-DSS. It performs comprehensive audits, identifies compliance gaps, and generates actionable implementation plans, technical controls, and policy templates to ensure adherence to industry standards.

Comprehensive checklist for application security hardening, covering input validation, output encoding, SQL/CSRF defenses, security headers, JWT best practices, secrets handling, rate limiting, and dependency audits to keep web services resilient.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.

A comprehensive toolkit for the full software development lifecycle. It guides stack selection using a detailed decision engine, automatically scaffolds complex boilerplate projects across multiple popular stacks (Next.js, MERN, FastAPI, Django), and provides deep code quality analysis. Features include security vulnerability detection, complexity scoring, and dependency auditing, ensuring high-quality development from the start.

Scans Solana and Anchor programs for six critical security vulnerabilities—arbitrary CPI, improper PDA validation, missing signer/ownership checks, sysvar spoofing, and instruction introspection issues—to support audits and pre-launch reviews.

This skill guides the mastery of smart contract security best practices for Solidity. It is essential for writing robust, secure, and efficient contracts, auditing existing code for common vulnerabilities (such as reentrancy, overflow, and access control issues), and implementing secure DeFi protocols. It focuses on preventing common attack vectors while optimizing gas usage.

This skill provides a structured approach to systematically identify security threats by applying the STRIDE methodology (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). It is crucial for conducting thorough threat modeling sessions, analyzing system architectures, reviewing security design decisions, and creating robust security documentation for compliance and auditing purposes.