Skill UI

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls using defense-in-depth strategy. Orchestrates specialized security agents for comprehensive assessments, layered controls, and continuous monitoring. Follows DevSecOps principles with shift-left security, automated scanning, and compliance validation to create a resilient security posture addressing vulnerabilities and future threats.

This skill performs Static Application Security Testing (SAST) to detect code vulnerabilities across multiple programming languages and frameworks. It helps identify injection flaws, hardcoded secrets, and security policy violations before deployment. Suitable for code reviews, compliance checks like OWASP, and legacy code assessment. Requires source code access and is not for runtime testing.

This skill creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. It guides users through a strict workflow including test-first development, AST analysis, and validation. Ideal for building static analysis detections, enforcing coding standards, and identifying data flow issues using taint mode.

This skill covers essential principles for managing production servers, focusing on decision-making rather than memorizing commands. It includes process management, monitoring strategies, log handling, scaling decisions, health checks, and security best practices to ensure system stability and reliability.

Implement service-to-service communication management using Istio or Linkerd. Configure mutual TLS (mTLS) for security, traffic shaping, and observability. Use this skill when managing microservices architecture, enabling canary deployments, enforcing authorization policies, and monitoring service health without changing application code.

This skill provides expert-level assistance in designing and managing service mesh architectures using tools like Istio and Linkerd. It covers traffic management, security policies, observability, and multi-cluster configurations. Ideal for implementing zero-trust networking, canary deployments, and debugging microservices communication in Kubernetes environments.

This skill identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. It evaluates whether interfaces are resistant to developer misuse, focusing on algorithm selection, default values, primitive types, and configuration cliffs. Use when reviewing API designs, cryptographic library ergonomics, or assessing authentication interfaces to ensure secure-by-default principles are followed.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks. Provides static analysis and manual review workflow.

Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data flow, and irreversible actions.

Convert approved documentation, repositories, or PDFs into reusable agent skills using the Skill Seekers workflow. Review generated content for triggers, guidance, and security before installation. Supports licensing checks and excludes private credentials.