Skill UI

This guide provides comprehensive security standards for integrating with the Flexport API. It covers critical best practices such as webhook signature verification, secure API key rotation, implementing least-privilege access controls, and data redaction for handling sensitive logistics and customs data. Essential for maintaining compliance and preventing data breaches in supply chain operations.

This comprehensive, zero-trust security auditor scans third-party AI agent skills before installation. It performs a rigorous 6-phase review process, analyzing surface patterns, script integrity, permissions, and supply chain risks. It is designed to detect malicious payloads, credential theft, instruction overrides, and prompt injection attacks, ensuring secure AI development and deployment.

A comprehensive guide detailing advanced security threats in Machine Learning and AI systems. Covers model supply chain attacks (RCE via pickle, poisoning), adversarial examples (FGSM, PGD, physical-world), data privacy breaches, and LLM-specific vulnerabilities. Essential for building robust, secure AI pipelines.

This skill runs the Bumblebee scanner on macOS/Linux to perform read-only inventory and exposure checks. It detects compromised packages, developer tools, and host configurations against known security advisories. It is primarily used for supply-chain incident response and vulnerability assessment, providing developers with a clear picture of local system exposure.

A comprehensive guide for securing container images and runtime environments. Covers best practices from Dockerfile authoring (minimal base images, multi-stage builds, non-root users) through advanced runtime enforcement (seccomp, AppArmor) and Kubernetes security controls. Essential for production hardening and maintaining supply chain integrity.

This skill provides deep security review for GitHub Actions workflow files. It focuses on the unique Actions threat model—identifying vulnerabilities like script injection via ${{ }} interpolation, privilege escalation from triggers (e.g., pull_request_target), and ensuring least-privilege permissions for CI/CD pipelines. Use it to audit, secure, or harden existing workflows, preventing attacks from untrusted inputs and supply chain risks.

This skill performs a comprehensive audit of project dependencies, identifying critical security vulnerabilities (CVEs), analyzing license compliance against established policies, and detecting outdated or risky packages. It produces an actionable report including an overall dependency health score and a prioritized, time-bound remediation plan, ensuring the software supply chain is secure and legally compliant.

A comprehensive workflow for establishing and maturing a Third-Party Risk Management (TPRM) program. This guide covers the entire vendor lifecycle, from initial inventory and risk tiering to conducting due diligence (SOC 2, ISO 27001), embedding security requirements in contracts, and ensuring continuous monitoring and secure offboarding. Essential for compliance and supply chain risk management.

This skill audits Model Context Protocol (MCP) servers to detect critical AI security vulnerabilities. It scans for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure. Use it before integrating new tools or during security reviews to ensure agent reliability and prevent supply chain attacks.

A critical security tool for detecting typosquatted, brandjacked, or misspelled packages across major registries (npm, PyPI, crates.io). It uses advanced techniques like edit-distance and corpus matching to proactively screen dependency names before installation. Ideal for implementing CI/CD gates, auditing lockfile diffs, or reviewing dependency lists sourced from AI models to mitigate supply chain attacks.

This guide provides a comprehensive methodology for the reverse engineering of browser extensions (Chrome/Firefox). It covers analyzing the manifest, tracing background workers, content scripts, and recovering sensitive logic like credentials or network traffic. Essential for security research, malware investigation, and supply chain security auditing.

A specialized downstream skill for CTF-sandbox workflows. Used to analyze complex security challenges driven by AI agent interactions, prompt injection, or infrastructure vulnerabilities. Focuses on tracing control chains involving untrusted input, tool side effects, deployment drift, container runtime issues, and CI/CD supply chain provenance. Ideal for rigorous vulnerability assessment in modern, distributed systems.