Skill UI

Provides Wycheproof test vectors for validating cryptographic implementations against known attacks and edge cases, making it ideal for CI regression sweeps and third-party crypto audits.

Defines strict guidelines for creating and maintaining Excel financial models, covering zero formula errors, industry color coding, number formatting, documented assumptions, and mandatory use of Excel formulas to ensure accuracy and auditability before recalculation.

Audits GitHub Actions workflows that invoke AI coding agents to surface prompt injection and sandbox risks, tracing attacker-controlled inputs through env vars, reusable actions, and workflow references before deployment or code review.

Systematically examines project dependencies, using GitHub data to highlight single-maintainer, unmaintained, unpopular, or otherwise risky packages before audits so teams can focus security efforts and propose better-maintained alternatives.

Detects missing zeroization of secrets and flags compiler-optimized removals with mandatory assembly/IR evidence, helping auditors verify C/C++/Rust cryptographic code through dataflow, CFG, and runtime validation.

This skill provides a comprehensive audit framework and optimization strategy for local SEO, specifically tailored for law firms, attorneys, and legal/professional service providers. It focuses on maximizing local visibility by optimizing Google Business Profiles (GBP), establishing critical E-E-A-T signals, and ensuring directory consistency. Use this when aiming to improve ranking in local Google packs, maps, and specialized legal directories.

A specialized assistant designed to act as a senior software architect. It critiques code generated by AI tools or rapidly prototyped code, moving beyond simple syntax checks. The auditor identifies deep structural flaws, technical debt, architectural weaknesses, and production risks (e.g., security vulnerabilities, poor error handling, tight coupling) that make code fragile or unsuitable for deployment.

This skill automates comprehensive API test suite creation for REST endpoints across frameworks like Next.js, Express, FastAPI, and Django. It scans route definitions to generate tests covering authentication, validation, error handling, pagination, and security edge cases. Ideal for TDD, legacy coverage, and security audits, it outputs ready-to-run test files for Vitest, Supertest, or Pytest.

This powerful tool helps translate natural language requirements into robust, normalized relational database schemas. It can generate comprehensive schema designs, complete with relationships, constraints, and advanced architectural concerns like multi-tenancy, soft deletes, and audit trails. Furthermore, it automates the generation of database migrations (supporting Prisma, TypeORM, Alembic, etc.), corresponding type definitions (TypeScript/Python), seed data, and Entity-Relationship Diagrams (ERD) using Mermaid.

A comprehensive guide for managing secrets and environment variables throughout the entire development lifecycle, from local development to production. This skill covers secret leak auditing (detecting committed credentials), implementing robust rotation workflows, and integrating with industry-leading secret stores like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. Essential for hardening CI/CD pipelines and ensuring compliance.

A comprehensive security scanner designed to audit AI agent skills before deployment. It analyzes source code (Python, Bash, JS), detects critical vulnerabilities like command injection, network exfiltration, and unsafe deserialization. Furthermore, it scans markdown files for prompt injection attacks, and assesses dependency supply chain risks, providing a clear PASS/WARN/FAIL verdict and remediation guidance.

Performs static security analysis on GitHub Actions workflows that incorporate AI coding agents (e.g., Claude, Gemini, OpenAI). This skill helps identify critical data flow vulnerabilities, such as where attacker-controlled input can reach AI agent prompts or internal systems via CI/CD pipelines, going beyond simple expression checks.