Skill UI

A comprehensive guide for securing container registries by enforcing vulnerability scanning (Trivy, Grype), generating Software Bill of Materials (SBOM), and implementing digital signing using Cosign and Sigstore. This solution is essential for establishing robust CI/CD pipelines and preventing supply chain attacks before image promotion.

CCPM orchestrates software delivery from PRD through epics and GitHub issues into parallel agent execution, covering planning, decomposition, syncing, workstart, and status checks with mandated script-based reporting.

This guide enforces the 'spec-first' principle in software development, treating the specification as a non-negotiable contract. It outlines a rigorous, multi-stage workflow detailing mandatory sections (Functional/Non-Functional Requirements, Acceptance Criteria, API Contracts, Data Models) and bounded autonomy rules. Users learn how to define the system 'must do' before writing a single line of code, thereby minimizing rework and eliminating scope creep.

This powerful tool parses Software Bill of Materials (SBOM) in CycloneDX and SPDX formats. It correlates identified components against the NVD CVE database via API, building dependency graphs and calculating risk scores. It is essential for assessing third-party risk, identifying transitive vulnerability paths, and generating comprehensive compliance reports for supply chain security.

This tool detects malicious packages mimicking legitimate dependencies in npm and PyPI. It analyzes package names using Levenshtein distance, examines publish date heuristics, and identifies download count anomalies to secure the software supply chain. Ideal for auditing project dependencies and proactively monitoring for supply chain threats.

Guides business leaders through capital expenditure decisions, comparing ROI, payback, NPV, IRR, and opportunity costs for equipment, hires, software, real estate, or service lines so every dollar is justified before deployment.

This guide details how to implement secure, keyless software signing using the Sigstore ecosystem components (Cosign, Fulcio, Rekor). It establishes cryptographic provenance for container images and binaries by binding identity via OIDC, ensuring verifiable integrity and tamper-proofing throughout the CI/CD supply chain.

AgentFlow transforms your existing Kanban board (Asana, GitHub, Linear) into a self-managing, autonomous AI development pipeline. It orchestrates multiple AI agents through defined stages (Backlog to Done), enforcing deterministic quality gates, performing adversarial reviews, and tracking costs—all visible within your existing project management UI. It provides crash-proof execution and full observability for complex software development lifecycles.

This skill manages comprehensive software development life cycle operations—including issue triage, PR reviews, version releases, bug fixing, and marketing content generation. It operates using a parallel "agent army" of dynamic agents (10-20 per task), requiring the user to adopt an Engineering Manager (EM) mindset. Key principles involve rigorous citation checking (anti-hallucination) and applying multiple roles (Product Owner, Open Source Contributor, Architect) simultaneously to ensure robust, safe, and user-centric outcomes across all platforms.

This skill provides comprehensive guardrails for handling Protected Health Information (PHI) in US healthcare software. It guides development teams on data classification, security best practices, access control, and audit logging to ensure strict adherence to HIPAA regulations. Use it when dealing with patient data storage, transmission, or processing to prevent breaches and maintain compliance.

Hookify rules enable developers to define custom, event-driven workflows using Markdown files with YAML frontmatter. These rules monitor specific operational events (such as bash commands, file edits, or user prompts) and can trigger warnings or block operations when predefined regex patterns are matched. They are essential for enforcing coding standards, preventing dangerous operations, and guiding development adherence in complex software environments.

Generates professional documentation for software projects, covering READMEs, API references, architecture guides, inline comments, and changelogs, adapting style and scope to the codebase and user request.