Skill UI

Auto-activating skill that guides analysts through forensics data collector operations, aligning advanced security practices with compliance frameworks while generating validated code and configurations for enterprise deployments.

Automates PCI DSS validator work by guiding advanced security practitioners through best practices, generating production-ready code/configurations, and validating results against compliance frameworks.

This skill simulates an expert cybersecurity auditor specializing in DevSecOps methodologies and comprehensive security assurance. It guides users through running detailed security audits, performing threat modeling, and assessing vulnerabilities (e.g., IDOR). Capabilities cover SAST, DAST, cloud security posture, zero-trust architectures, and compliance adherence to major frameworks like GDPR, HIPAA, and PCI-DSS, ensuring security is integrated throughout the entire SDLC.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Automated assistant for SOC2 compliance checks that guides security teams through best practices, code/configuration generation, and validation within advanced enterprise frameworks.

Analyze frameworks, platforms, and cloud providers with weighted scoring, ecosystem health, TCO, security, and migration insights so decision makers can confidently compare stacks before committing.

Master advanced testing strategies for smart contracts using industry-leading frameworks like Hardhat and Foundry. This skill covers unit testing, integration testing, gas optimization analysis, fuzzing for edge cases, and simulating real-world mainnet interactions via forking. Ideal for ensuring the security and reliability of decentralized applications (DApps).

Automatically scans modern API frameworks (Next.js, Express, FastAPI, Django) to generate comprehensive, ready-to-run test suites. It ensures complete coverage for critical areas including authentication, input validation (boundary/injection), error code matrices, pagination, file uploads, and rate limiting. Ideal for TDD, contract testing, and security audits.

A comprehensive guide and set of scripts to systematically audit AWS S3 buckets for security misconfigurations. This tool identifies publicly exposed data, overly permissive ACLs, inadequate bucket policies, and missing encryption settings, ensuring adherence to least-privilege principles and compliance frameworks like SOC 2 or HIPAA.

A comprehensive, structured playbook for Security Operations Centers (SOCs) detailing the entire lifecycle of ransomware incidents. It guides analysts through detection (SIEM queries), triage decision trees, containment (EDR/Firewall), evidence collection, and recovery phases, adhering to NIST CSF and MITRE ATT&CK frameworks.

This system provides a structured workflow for tracking security vulnerability exceptions and formally accepting related risks. It mandates documentation of compensating controls, manages required approval chains, and automatically handles expiration based on defined Service Level Agreements (SLAs). Essential for maintaining compliance and visibility into accepted risks, supporting frameworks like PCI DSS, SOC 2, and NIST CSF.

This process validates the necessity of elevated permissions across critical accounts, including domain admins, service accounts, and cloud IAM roles. It is a core identity governance function mandated by major compliance frameworks (SOX, PCI DSS) to enforce the principle of least privilege, detect stale or excessive access, and ensure continuous security compliance.