Skill UI

This skill implements a robust, multi-layered security hardening process based on the Defense-in-Depth strategy and DevSecOps principles. It coordinates specialized agents to perform comprehensive security assessments (SAST, DAST, SBOM, Threat Modeling), identify critical vulnerabilities, and execute layered remediation. The process covers application code, backend APIs, frontend components, and mobile platforms, ensuring a resilient security posture across the entire development lifecycle.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.

Guides you through building custom Semgrep rules with a testing-first workflow, AST analysis, and taint-mode preference to catch vulnerabilities or bug patterns while steering clear of overly broad or unverified shortcuts.

Scans Solana and Anchor programs for six critical security vulnerabilities—arbitrary CPI, improper PDA validation, missing signer/ownership checks, sysvar spoofing, and instruction introspection issues—to support audits and pre-launch reviews.

This skill guides the mastery of smart contract security best practices for Solidity. It is essential for writing robust, secure, and efficient contracts, auditing existing code for common vulnerabilities (such as reentrancy, overflow, and access control issues), and implementing secure DeFi protocols. It focuses on preventing common attack vectors while optimizing gas usage.

Scans Substrate/Polkadot FRAME pallets for seven critical vulnerabilities such as arithmetic overflow, panic DoS, incorrect weights, unsigned validation issues, bad randomness, and origin flaws, making it ideal for runtime audits and pre-launch security assessments.

Scans FunC-based TON smart contracts for boolean, Jetton, and gas handling vulnerabilities, reporting critical issues with file references and offering remediation guidance for auditors and secure dApp launches.

Provides a structured reference covering the 100 most critical web vulnerabilities, including definitions, root causes, impacts, and mitigation guidance aligned with OWASP categories to support assessments and remediation planning.

Provides a structured reference of the 100 most critical web application vulnerabilities organized by category, helping security teams identify attack vectors, assess impacts, and follow remediation guidance during audits or penetration tests.

Validating Authentication Implementations assesses authentication mechanisms like JWT, OAuth, sessions, and API keys against security standards, then reports vulnerabilities and recommendations for password policy, MFA, token handling, and session security.

Analyzes CORS configurations via the cors-policy-validator plugin to spot misconfigurations, validate headers or files, and report vulnerabilities so developers can secure web apps and APIs from unsafe cross-origin access.