Skill UI

Windsurf is a powerful, AI-powered code editor built on VS Code. This guide covers the complete setup process, including initial installation for macOS/Linux/Windows, crucial Codeium authentication using Google/GitHub, and advanced configuration for enterprise or team deployments. Learn to use Supercomplete and interact with the Cascade AI agent to boost your development workflow.

This comprehensive guide outlines the process of migrating development teams from established AI Integrated Development Environments (IDEs) like VS Code/Copilot or Cursor to Windsurf. It covers technical steps such as converting project rules, transferring settings and keybindings, and planning a structured, phased team rollout and rollback strategy for a smooth transition.

A comprehensive guide for upgrading Windsurf IDE to new versions and migrating settings, extensions, and configurations from competing editors like VS Code or Cursor. It details manual migration steps, handles breaking changes, and introduces Windsurf-specific features like Cascade Workflows and Turbo Mode.

This skill guides the development of custom extensions for the Windsurf environment, leveraging the full VS Code Extension API. You will learn to track various workspace events—such as file saves, editor changes, and terminal outputs—and integrate this data with external services by sending structured webhooks. This is essential for building complex workflow automation, implementing custom IDE features, or creating data analytics tools within the development lifecycle.

This skill automates the creation of isolated, pre-configured development containers (devcontainers). It scans the project structure to detect supported languages (Python, Node.js, Rust, Go) and intelligently generates the necessary configuration files, VS Code extensions, and setup scripts. It ensures all required tools are installed in a sandboxed environment, making it ideal for starting new multi-language projects or needing consistent, reproducible development workspaces.

A comprehensive enterprise-grade security engine designed to discover, classify, protect, and govern all credentials, API keys, and secrets across the entire application lifecycle. It provides continuous governance by auditing code repositories, CI/CD pipelines, runtime logs, and infrastructure configurations to prevent exposure and enforce least privilege principles. Ideal for implementing DevSecOps best practices.

A comprehensive solution for identifying and preventing the accidental commitment of exposed AWS credentials, API keys, and session tokens within source code, configuration files, and git history. It integrates TruffleHog and git-secrets into CI/CD pipelines and pre-commit hooks, providing critical protection against credential theft and unauthorized cloud access in a DevSecOps environment. Essential for security auditing and compliance.

This tool analyzes Windows Event Logs (ID 4688, Sysmon ID 1) and WMI-Activity Operational events to detect suspicious lateral movement. It specifically hunts for WmiPrvSE.exe spawning child processes (like cmd.exe or powershell.exe) or identifying WMI event subscriptions, which are common indicators of remote code execution and persistence.

This guide details how to implement coverage-guided fuzz testing using AFL++ within CI/CD pipelines. It covers building the fuzzing harness, utilizing advanced instrumentation (like AddressSanitizer), and configuring automated runs to discover memory corruption and input handling vulnerabilities in compiled applications. Ideal for strengthening DevSecOps practices and ensuring code reliability.

This guide details implementing Policy-as-Code using Open Policy Agent (OPA) and Gatekeeper. It covers writing complex Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, and integrating policy testing into CI/CD pipelines to enforce security standards across clusters. Ideal for DevSecOps practitioners requiring robust governance.

Semgrep is an open-source static analysis tool used to find bugs, detect vulnerabilities, and enforce coding standards. This guide covers writing custom rules in YAML format to implement advanced SAST checks, such as detecting SQL injection, hardcoded secrets, or tracking tainted user input. It is essential for building robust DevSecOps pipelines and ensuring compliance.

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).