Skill UI

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

Guides you through building custom Semgrep rules with a testing-first workflow, AST analysis, and taint-mode preference to catch vulnerabilities or bug patterns while steering clear of overly broad or unverified shortcuts.

Ports an existing Semgrep rule into each requested language by running applicability analysis, test-first creation, AST-informed rule translation, and validation so that every target-language variant has its own rule+test directory.

A comprehensive toolset for the full backend development lifecycle. This suite enables developers to scaffold API routes from OpenAPI specifications, manage complex database migrations and optimization (PostgreSQL), and perform rigorous load/performance testing. It supports building robust microservices, securing REST APIs, and ensuring system scalability.

A comprehensive toolkit for ensuring code quality in modern React and Next.js applications. It automatically generates unit test stubs using Jest and React Testing Library, scaffolds Playwright E2E tests for entire application routes, and analyzes coverage reports to identify crucial testing gaps. Ideal for developers looking to establish, improve, and maintain robust, enterprise-grade test suites.

This central skill specializes in performing comprehensive threat modeling using STRIDE and calculating risk via DREAD scoring. It guides users through defining scope, identifying threats, and planning mitigations for new architectures. Crucially, it acts as a security router, directing specialized requests—such as pen-testing, incident response, cloud posture checks, and AI security reviews—to the appropriate dedicated skill.

This skill provides a comprehensive walkthrough for setting up and testing Sentry error monitoring using both Node.js and Python SDKs. It demonstrates how to capture various event types, including simple messages and full exceptions, and crucially, how to enrich these events with user context, searchable tags, and detailed breadcrumbs. This is essential for verifying robust error logging and monitoring in a production environment.

This specialized skill generates comprehensive, best-practice SEO metadata packages, including optimized titles, compelling descriptions, and structured URLs. It ensures strict compliance with character limits (e.g., 150-160 characters) while strategically integrating primary and secondary keywords, emotional triggers, and clear CTAs. Use this when launching new content or needing A/B test variations to maximize search visibility and click-through rates across platforms.

Master systematic methodologies for using Shodan to perform deep reconnaissance during penetration testing. This skill covers querying exposed services, mapping assets, identifying vulnerable systems (CVEs), and utilizing advanced filters for IP ranges, geographical locations, and organizational data. Ideal for security researchers and ethical hackers.