Skill UI

A comprehensive skill for performing deep security audits and writing secure code in Go. It guides developers through identifying vulnerabilities like SQL injection, XSS, path traversal, and crypto misuse. The framework incorporates advanced techniques such as STRIDE/DREAD threat modeling, data flow tracing, and multi-stage review modes (Audit, Review, Coding), ensuring defense in depth for robust Go applications.

Security-first development practices for web applications. Covers threat modeling with STRIDE, OWASP Top Ten defenses, input validation, parameterized queries, authentication and session hardening, security headers, dependency auditing, and supply-chain risk assessment.

Conducts STRIDE-A threat modeling on repositories or systems, running either a full single-pass analysis with architectures, DFDs, prioritized findings, and executive assessments, or an incremental update that compares a baseline report to the current code and highlights deltas.

This guide details how to deploy OpenCTI, a powerful, open-source threat intelligence platform, and utilize the pycti Python client. It teaches analysts how to model complex cyber threat intelligence, including threat actors, campaigns, and indicators, into a structured STIX 2.1 knowledge graph. Use this for centralized threat-intel correlation, building adversary graphs, and generating STIX bundles for detection engineering.

A comprehensive audit worker that integrates Open Infrastructure Architecture (OIA) manifest analysis, threat modeling, and MCP security scanning. It computes a composite worst-case severity score and persists time-stamped audit records in a memory namespace. Primarily designed for scheduled CI/CD pipelines to detect architectural drift and security regressions over time.

A comprehensive tool for authors targeting the ACM Asia Conference on Computer and Communications Security (ASIACCS). It provides expert guidance on assessing whether a computer and communications security manuscript is a strong fit for this specific, high-impact venue. Topics covered include conference fit assessment, evidence bar establishment, manuscript re-framing strategies, threat modeling, and proper community positioning for maximum review impact.

This comprehensive guide helps authors strategically position their computer security manuscripts for the ACM Conference on Computer and Communications Security (CCS). It details topic fit, required threat modeling, evidence presentation, and critical comparisons with sister venues (e.g., S&P, USENIX Security). It serves as a high-level 'fit/framing' tool for maximizing submission success in core areas like privacy, cryptography, and systems security.

A comprehensive strategic guide for authors targeting the IEEE Symposium on Security and Privacy (S&P). This skill helps evaluate if a computer science manuscript is a proper fit for the venue by covering rigorous threat modeling, ethical considerations, evidence requirements, and how to strategically frame the contribution. Use this when determining conference submission strategy or refining security-focused academic research.

This skill generates fully valid Microsoft Threat Modeling Tool (.tm7) files. It translates complex system architectures, including components, data stores, data flows, and external actors, into the required WCF DataContractSerializer XML format. Use it for structured STRIDE threat modeling outputs compatible with Microsoft's official tool.

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

This advanced skill performs server-enforced security and privacy reviews for applications, including those rapidly developed with AI agents. It implements comprehensive models like STRIDE (security) and LINDDUN (privacy), screens dependencies against live CVE/CISA data, and evaluates applicability of major EU regulations (GDPR, AI Act, NIS2). The output is a formal, auditable compliance report, never a simulated chat response or legal verdict.

This skill performs comprehensive security audits, including hardening, threat modeling (STRIDE/PASTA), Red/Blue Team exercises, OWASP checks, code review, and incident response. It is designed for infrastructure security across any project. Users should ensure authorization before execution and treat findings as advisory triage rather than proof of exploitability.