Skill UI

This expert skill advises critical infrastructure owners and operators (pipelines, railroads, public transit) on complying with complex TSA cybersecurity directives. It provides deep knowledge of CRMP, CIP, CAP, IT/OT segmentation, and incident reporting protocols. Use it for gap assessments, policy drafting, and security architecture reviews related to transportation critical systems.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.

Secure LLM and AI systems against prompt injection, data exfiltration, model theft, and supply chain attacks in production environments. This skill covers input sanitization, output filtering, PII scrubbing, and API endpoint protection to ensure compliance with SOC2 or ISO 27001 standards.

Orchestrate complex multi-phase objectives into guided sequences of skill invocations. Use for shipping SaaS MVPs, web security audits, AI agent systems, browser QA, and DDD domain modeling with verified checkpoints.

This skill specializes in creating realistic mock services for development, testing, and demonstration purposes. It simulates real API behavior to enable parallel development and facilitate thorough testing. Use it for building mock APIs for frontend or integration testing, simulating partner APIs, creating demo environments, and validating API contracts before backend completion. Avoid using for production systems or security testing.

This skill provides expert-level review and guidance for complex software systems. It covers modern architecture patterns like microservices, event-driven design, and clean architecture. The architect evaluates scalability, resilience, security, and maintainability. It helps ensure architectural integrity and compliance with best practices across distributed systems and cloud-native environments.

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

Master secure authentication and authorization implementation using industry-standard patterns. Covers user login systems, REST/GraphQL API security, OAuth2, SSO, session management, and RBAC design. Includes guidance on token lifecycle, secrets storage, and threat modeling to protect resource access boundaries effectively.

Expert backend architect for scalable API design, microservices, distributed systems, resilience, security, and observability.

This skill audits deployed web apps for exposed secrets like hardcoded API keys and tokens in JavaScript or HTML. It checks for publicly reachable config files and security header misconfigurations. It is a defensive, read-only workflow for authorized security reviews to identify potential data leaks without exploiting systems.

Secure Docker images and runtime configurations by implementing best practices like non-root users, read-only filesystems, and capability dropping. Includes Kubernetes security contexts and image scanning guidance to meet defense-in-depth requirements. Helps reduce attack surface and ensure compliance with security standards.

Run comprehensive, read-only exposure checks against your local machine or project directories in response to security advisories and CVEs. This tool systematically checks various ecosystems (Node.js, Python, Homebrew, etc.) to generate a structured, non-invasive audit report, helping users understand their actual risk exposure without making any system changes.