Skill UI

Grype is an open-source vulnerability scanner by Anchore that inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated Software Bill of Materials (SBOMs) to match packages against multiple databases including NVD, GitHub Advisories, and OS-specific feeds. It is ideal for security assessments, CI/CD integration, and implementing severity-based build gates.

This powerful tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates identified components against the NVD CVE database via API, building dependency graphs and calculating risk scores. It is essential for assessing third-party risk, identifying transitive vulnerability paths, and generating comprehensive compliance reports for supply chain security.

This skill provides comprehensive guardrails for handling Protected Health Information (PHI) in US healthcare software. It guides development teams on data classification, security best practices, access control, and audit logging to ensure strict adherence to HIPAA regulations. Use it when dealing with patient data storage, transmission, or processing to prevent breaches and maintain compliance.

This prompt guides software engineers to create comprehensive technical implementation plans for new features. It covers system architecture, database design, API specifications, frontend structure, and security considerations within a monorepo environment. Ideal for planning SaaS features before coding begins.

This skill generates a complete, actionable CI/CD playbook, thoroughly documenting the entire software deployment lifecycle. It covers essential stages like build & linting, unit/integration testing, security scanning, and phased deployment to staging and production. The output provides clear guidelines on required inputs, automated gates, manual approvals, and necessary rollback procedures, which is crucial for engineering documentation and team onboarding.

This skill performs a comprehensive audit of project dependencies, identifying critical security vulnerabilities (CVEs), analyzing license compliance against established policies, and detecting outdated or risky packages. It produces an actionable report including an overall dependency health score and a prioritized, time-bound remediation plan, ensuring the software supply chain is secure and legally compliant.

A comprehensive framework designed for formal procurement decision-making. This skill guides the creation of a weighted scorecard and detailed evaluation criteria by assessing functional fit, commercial terms, security compliance, and vendor stability. Use this when conducting RFPs, comparing multiple suppliers, or making critical software/service provider choices to ensure a holistic, risk-mitigated recommendation.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

This skill provides comprehensive guardrails for handling Protected Health Information (PHI) in US healthcare software. It guides development teams on data classification, security best practices, access control, and audit logging to ensure strict adherence to HIPAA regulations. Use it when dealing with patient data storage, transmission, or processing to prevent breaches and maintain compliance.

A comprehensive guide for positioning computer science manuscripts for top-tier security conferences like USENIX Security. It covers core topics (systems, network, privacy, software security), required evidence (rigorous artifact, measurement, vulnerability analysis), and strategic advice on framing the work to meet adversarial reviewer expectations. Ideal for authors preparing high-stakes academic submissions.

This advanced skill specializes in tracing the complete provenance of software artifacts across the entire development lifecycle. It is designed for deep security analysis of CI/CD pipelines, identifying dependency drift, build tampering, package origin, and determining the final artifact consumed at runtime. Use it when investigating integrity vulnerabilities in complex release flows.

A sophisticated, multi-agent system designed to perform deep, comprehensive code reviews on pull requests. It covers core elements like code quality, functionality, security vulnerabilities, and testing coverage. Advanced features include detecting scope drift, enforcing SOLID principles, identifying DRY violations, and providing anti-hallucination safeguards for maintain high software integrity.