Skill UI

Conducts detailed accessibility audits for web apps via the accessibility-test-scanner plugin, verifying WCAG 2.1/2.2 compliance, ARIA usage, keyboard navigation, and screen reader compatibility while providing remediation guidance when accessibility or compliance checks are requested.

Automatically scans code and configs using the data-privacy-scanner plugin to flag sensitive data exposure and compliance violations for privacy audits.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

A comprehensive guide to implementing secure secrets management practices for Continuous Integration/Continuous Deployment (CI/CD) pipelines. It covers using industry-leading tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager to securely store, retrieve, and automatically rotate credentials (API keys, database passwords, TLS certificates) without hardcoding them into source code. Includes best practices for least-privilege access and audit logging.

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

This skill simulates an expert cybersecurity auditor specializing in DevSecOps methodologies and comprehensive security assurance. It guides users through running detailed security audits, performing threat modeling, and assessing vulnerabilities (e.g., IDOR). Capabilities cover SAST, DAST, cloud security posture, zero-trust architectures, and compliance adherence to major frameworks like GDPR, HIPAA, and PCI-DSS, ensuring security is integrated throughout the entire SDLC.

This expert simulates a compliance expert, specializing in regulatory requirements for software systems, including GDPR, HIPAA, SOC2, and PCI-DSS. It performs comprehensive audits, identifies compliance gaps, and generates actionable implementation plans, technical controls, and policy templates to ensure adherence to industry standards.

Comprehensive checklist for application security hardening, covering input validation, output encoding, SQL/CSRF defenses, security headers, JWT best practices, secrets handling, rate limiting, and dependency audits to keep web services resilient.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

Runs Semgrep static analysis with auto language detection, parallel Task subagents, Semgrep Pro checks, and configurable “run all” or “important only” modes to audit codebases for vulnerabilities and bug patterns.