Skill UI

Scans your codebase with pattern matching and entropy analysis to detect exposed secrets like API keys, passwords, and private keys, then generates remediation reports so you can fix vulnerabilities before committing or deploying code.

A comprehensive guide to implementing secure secrets management practices for Continuous Integration/Continuous Deployment (CI/CD) pipelines. It covers using industry-leading tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager to securely store, retrieve, and automatically rotate credentials (API keys, database passwords, TLS certificates) without hardcoding them into source code. Includes best practices for least-privilege access and audit logging.

Comprehensive checklist for application security hardening, covering input validation, output encoding, SQL/CSRF defenses, security headers, JWT best practices, secrets handling, rate limiting, and dependency audits to keep web services resilient.

Provides authentication, authorization, encryption, secrets, and hardening patterns for designing secure auth flows, managing tokens, configuring CORS, and implementing best practices around API keys, JWT, OAuth, and rate limiting.

Provides comprehensive security review guidance for authentication, input handling, secrets, APIs, and payment-sensitive workflows, with actionable checklists covering secrets, validation, SQL injection, auth, XSS, CSRF, rate limits, and sensitive data handling.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

This guide outlines essential security best practices for integrating the Speak API. It covers critical areas like securing API keys using secrets managers, ensuring audio data privacy by deleting local files, and maintaining compliance with major regulations such as COPPA and FERPA. Use this knowledge when building production-ready, secure language learning applications.

Checklist covering Spring Security best practices for authentication, authorization, validation, CSRF, secrets, headers, rate limiting, dependency scans, and logging in Java Spring Boot services.

This comprehensive skill guides the full lifecycle management of Supabase projects in a production environment. It covers essential DevOps practices, including running database migrations, deploying Edge Functions, managing secrets, implementing zero-downtime blue/green rollouts, and executing robust rollback procedures and post-deployment health checks. Ideal for ensuring stable and reliable production deployments.

This skill guides the setup of a robust, multi-environment architecture for Supabase, ensuring complete data isolation between development, staging, and production projects. It covers best practices for managing separate environment-specific secrets, safe database migration promotion (db push), environment-aware client initialization, and implementing safeguards to prevent accidental cross-environment operations in production. Essential for scaling SaaS applications.

This skill provides robust guidelines and patterns for managing environment variables and sensitive credentials securely. It is designed to ensure that secrets, API keys, and other confidential information are never accidentally exposed or logged in Claude sessions, terminal outputs, development logs, or version control commits (like Git). Use this skill when handling sensitive data in development workflows to maintain maximum security.