Skill UI

A rigorous framework designed to audit GitHub Actions workflows for exploitable security vulnerabilities. This skill focuses strictly on real-world attack patterns, requiring every identified finding to include a concrete exploitation scenario (Entry Point, Payload, Impact). Ideal for securing CI/CD pipelines against external attackers.

Scans Go codebases for security vulnerabilities, highlighting risky patterns, insecure dependencies, and misconfigurations so auditors can catch issues before deployment.

Leverages Monte Carlo-based simulation to spot potential software vulnerabilities by feeding randomized inputs into modules, tracking failure likelihoods, and highlighting risky code paths for security testing.

Python Security Auditor is a concise tool that inspects Python codebases for common vulnerabilities and configuration issues, helping developers prioritize fixes and maintain secure deployments.

Automated Rust Security Auditor for analyzing crate source code to spot vulnerabilities, dependency issues, and unsafe patterns before deployment across teams.

This skill provides a comprehensive guide for creating production-quality custom Semgrep rules. It teaches best practices for detecting security vulnerabilities, enforcing robust coding standards, and identifying specific bug patterns. By emphasizing a test-first approach and utilizing advanced techniques like taint mode, users can write highly accurate static analysis rules that drastically reduce false positives.

A comprehensive, multi-phase security audit tool designed to evaluate AI agent skills before deployment. It detects critical vulnerabilities, including prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks, ensuring the integrity and safety of your agent environment.

A systematic skill for identifying similar vulnerabilities and bugs across large, complex codebases. It guides the user through generalizing initial bug patterns using techniques like CodeQL and Semgrep, ensuring comprehensive security audits beyond the initially discovered flaw. Ideal for advanced security research and robust code auditing.

This comprehensive guide covers essential security patterns for Perl development, addressing common vulnerabilities like SQL Injection, XSS, Path Traversal, and Shell Injection. It details best practices including using Perl's Taint Mode, implementing strict allow-list validation, performing safe file operations, and executing external commands securely to ensure robust and resilient applications.

This tool parses API Gateway access logs from various providers (AWS, Kong, Nginx). It performs statistical analysis using pandas to detect critical security threats such as Broken Object Level Authorization (BOLA/IDOR), credential stuffing, rate limit bypass attempts, and injection vulnerabilities. Ideal for SOC analysts or security engineers investigating API abuse and building advanced threat detection rules.

A comprehensive skill for performing deep security audits on Ethereum smart contracts. Utilizes both static analysis (Slither) and symbolic execution (Mythril) to detect critical vulnerabilities such as reentrancy, integer overflows, and access control issues. This process is crucial for ensuring the security and immutability of financial assets before mainnet deployment.

This guide details comprehensive methods for auditing Terraform infrastructure-as-code (IaC) against security misconfigurations. By leveraging industry-standard tools like Checkov, tfsec, Terrascan, and Open Policy Agent (OPA), users can detect critical vulnerabilities—such as overly permissive IAM policies, public resource exposure, and missing encryption—before cloud deployment. It is essential for integrating robust security gates into CI/CD pipelines and enforcing compliance standards.