Skill UI

Run comprehensive, read-only exposure checks against your local machine or project directories in response to security advisories and CVEs. This tool systematically checks various ecosystems (Node.js, Python, Homebrew, etc.) to generate a structured, non-invasive audit report, helping users understand their actual risk exposure without making any system changes.

This comprehensive guide outlines a rigorous, human-in-the-loop engineering workflow for leveraging advanced AI agents to complete complex implementation tasks. It mandates defining clear completion criteria, decomposing work into manageable units, and strategically routing models (Haiku, Sonnet, Opus) based on task complexity. The workflow emphasizes continuous evaluation, regression testing, security review of invariants and edge cases, and strict cost discipline to ensure robust and reliable software development using AI assistance.

This skill performs an adversarial audit of web application authentication flows. It systematically probes for critical security vulnerabilities such as missing CSRF protection, insecure session cookies (lacking Secure/HttpOnly flags), risky cross-origin redirects, and OAuth misconfigurations. It generates a structured report detailing findings and severity levels, making it ideal for pre-deployment security audits and regression testing.

This utility manages scheduled, persistent background workers using the `CronCreate` mechanism. Unlike simple in-session loops, scheduled cron jobs survive system restarts, making them ideal for Continuous Integration (CI), system monitoring, and scheduled maintenance tasks (e.g., security audits, performance optimization, data consolidation). Users can define various recurring schedules and understand the difference between persistent cron scheduling and active session looping.

A comprehensive guide detailing security patterns and audit checklists for Automated Market Maker (AMM) smart contracts in DeFi. Covers critical vulnerabilities such as flash loans, slippage, reentrancy attacks, price manipulation, and integer overflow/underflow. Essential for reviewing major DeFi protocols like Uniswap.

This comprehensive tool scans all project dependencies against databases of known CVEs (Common Vulnerabilities and Exposures) and security vulnerabilities. It is essential for conducting thorough security audits of third-party packages, ensuring code quality before major releases, or responding to specific security advisories. It provides actionable reports categorized by severity.

A comprehensive guide covering essential security best practices for Django applications. It details how to implement robust authentication, granular authorization (RBAC), and crucial security settings like CSRF/XSS protection, HSTS, and secure environment configuration to prevent common vulnerabilities in production deployments.

This skill provides comprehensive operational controls for long-lived, cloud-hosted agent workloads. It manages the entire lifecycle—from deployment and scaling to observability and security. Features include detailed monitoring (logs, metrics, traces), safety controls (kill switches, least privilege), and robust change management processes (rollout, rollback, auditing). Ideal for mission-critical microservices and background agents.

This skill provides comprehensive automation for managing GitHub workflows across the entire development lifecycle. It covers detailed issue triage, PR review status checks, CI/CD failure debugging, official release management, and security monitoring using the GitHub CLI. Ideal for maintaining open-source project health and streamlining team development processes.

Performs a pure, read-only static security scan of a harness's declared MCP surfaces. It analyzes policy, permission, and dependency issues by reading manifest files (e.g., .mcp/servers.json and .harness/claims.json) without executing any underlying tools. Designed for integration into CI/CD pipelines to enforce security policies and ensure compliance.

This tool executes the advanced `metaharness/darwin` security benchmark (ADR-155). It rigorously evaluates the security detection capabilities of AI systems against a controlled ground-truth corpus, providing critical metrics like TPR, FPR, and patch-pass rates. It compares the champion model against multiple baselines, offering empirical data crucial for iterative security improvement and drift detection.

This skill generates an enterprise-grade threat model report using the `harness threat-model` command. It categorizes threats across the MCP surface, providing a detailed report including the overall worst severity (clean, low, medium, high) and specific findings. Ideal for pre-launch security reviews and periodic audits when sharing findings with an InfoSec team.