Skill UI

Implement secure secret storage and retrieval in CI/CD pipelines using tools like Vault or AWS Secrets Manager. Covers identity management, credential rotation, and security best practices to prevent exposure.

A security payload collection containing XSS, SSRF, and SQL injection payloads, CSP/WAF bypass techniques, wordlists, and submission rules for authorized penetration testing.

Expert security auditor for DevSecOps, application security, and compliance. Performs threat modeling, vulnerability assessment, secure code review, and CI/CD security integration to build resilient, compliant systems.

Automate security workflows and remediation processes. Build security pipelines for scanning, compliance checks, and SOAR capabilities. Ideal for scaling security operations or implementing DevSecOps strategies. Includes scripts for secret scanning, SAST, dependency checks, and automated incident response playbooks.

This skill generates a concise and enforceable security policy document for applications handling sensitive data. It creates a single coherent Blue Book using MUST, SHOULD, and CAN language, defining explicit assumptions, scope, and security gates. The workflow includes gathering context, drafting the policy, enforcing guardrails against secrets, and performing quality checks on threat models and data handling rules.

This skill provides a comprehensive security hardening checklist for reviewing scoped architectures. It covers network security, authentication, API safety, data protection, secrets management, supply chain dependencies, and incident response protocols. It ensures compliance with standards like GDPR, PCI-DSS, and HIPAA where applicable. Use this to validate controls against evidence-based practices before production deployment.

This expert simulates a compliance expert, specializing in regulatory requirements for software systems, including GDPR, HIPAA, SOC2, and PCI-DSS. It performs comprehensive audits, identifies compliance gaps, and generates actionable implementation plans, technical controls, and policy templates to ensure adherence to industry standards.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls using defense-in-depth strategy. Orchestrates specialized security agents for comprehensive assessments, layered controls, and continuous monitoring. Follows DevSecOps principles with shift-left security, automated scanning, and compliance validation to create a resilient security posture addressing vulnerabilities and future threats.

This skill performs Static Application Security Testing (SAST) to detect code vulnerabilities across multiple programming languages and frameworks. It helps identify injection flaws, hardcoded secrets, and security policy violations before deployment. Suitable for code reviews, compliance checks like OWASP, and legacy code assessment. Requires source code access and is not for runtime testing.

This skill creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. It guides users through a strict workflow including test-first development, AST analysis, and validation. Ideal for building static analysis detections, enforcing coding standards, and identifying data flow issues using taint mode.