Skill UI

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This skill provides a structured methodology for reviewing code commits intended to fix security vulnerabilities or address audit findings. It ensures that the original root cause is properly resolved, verifies the fix hasn't introduced new bugs or vulnerabilities (regressions), and validates the overall completeness of the remediation effort. Ideal for security-critical code reviews.

This skill acts as a comprehensive security scanner specializing in detecting Cross-Site Scripting (XSS) vulnerabilities in client-side code. It performs static analysis across React, Vue, Angular, and vanilla JavaScript, specifically identifying unsafe practices like direct HTML manipulation (innerHTML), raw rendering (v-html), and insecure URL handling. Use it when auditing frontend code for security flaws and needing best practices for secure coding.

An expert skill dedicated to building secure, robust frontend applications. It specializes in preventing client-side vulnerabilities such as XSS and clickjacking. Core capabilities include safe DOM manipulation, implementing Content Security Policy (CSP), advanced input sanitization (allowlisting), and securing complex interactions like secure redirects and session management.

Claude generates comprehensive security audit reports by analyzing system and application security data, identifying vulnerabilities, checking compliance, and suggesting remediation steps via the /audit-report command.

A specialized security auditor for Laravel applications. It analyzes code, APIs, and configurations against OWASP standards to detect vulnerabilities such as XSS, IDOR, SQL injection, and misconfigurations. Ideal for reviewing backend logic to ensure robust data protection and authorization.

A comprehensive guide for authorized security assessments, detailing systematic methods to escalate user privileges from low-level access to root control on Linux systems. Techniques covered include comprehensive system enumeration, exploiting kernel vulnerabilities (e.g., dirty pipe), abusing misconfigured sudo permissions (using gtfobins), and exploiting vulnerable SUID binaries.

Provides cross-language patterns for developing memory-safe systems code. This skill covers crucial concepts like RAII, ownership models, smart pointers, and robust resource management. It is essential for preventing common vulnerabilities such as use-after-free, memory leaks, and ensuring reliable resource handling across complex systems.

This expert specializes in secure mobile development practices, covering areas like input validation, WebView security, secure data storage (KeyStore/Keychain), and advanced network security (Certificate Pinning). Use this skill to write secure, resilient mobile code for both iOS and Android, mitigating platform-specific vulnerabilities and ensuring sensitive data protection.

A comprehensive specialist that combines automated static analysis (SonarQube, CodeQL, Semgrep) with advanced AI capabilities. This tool performs multi-layered code reviews assessing security vulnerabilities, performance bottlenecks, architectural coherence, and maintainability across various programming languages, integrating seamlessly into CI/CD pipelines.

Conducts in-depth security audits across code, infrastructure, and configurations using the security-pro-pack toolkit to surface vulnerabilities, compliance gaps, and cryptographic weaknesses along with actionable remediation guidance.

Automates Claude Code plugin audits whenever audit or security keywords appear, checking for vulnerabilities, compliance with CLAUDE.md standards, marketplace/MCP requirements, best practices, documentation, and repository hygiene before emitting a structured report.