Skill UI

A comprehensive, multi-phase workflow designed for conducting deep security audits across modern web applications and APIs. This bundle guides users through the entire security lifecycle, including reconnaissance, vulnerability scanning (SAST/DAST), specific testing for OWASP Top 10 and injection flaws, specialized API fuzzing, full-scope penetration testing, security hardening, and final risk reporting. Ideal for compliance checks and proactive security enhancement.

Automates the creation and validation of security headers by guiding users through authentication, input validation, secure coding, and vulnerability detection practices within the Security Fundamentals domain.

This skill specializes in transforming theoretical threat models, risk assessments, and business context into concrete, actionable security requirements. It is essential for writing detailed security user stories, defining robust acceptance criteria, building comprehensive security test cases, and ensuring compliance requirement mapping. Use it when bridging the gap between identifying a vulnerability and specifying how the system must be secured.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Perform Static Application Security Testing (SAST) to identify critical security vulnerabilities, including SQL injection, XSS, hardcoded secrets, and path traversal, directly from source code. Supports multi-language ecosystems (Python, JavaScript, Java, Go, etc.) and major frameworks, enabling crucial pre-deployment security validation and compliance checks (OWASP, PCI-DSS).

Guides authorized practitioners through Nmap, Masscan, Nessus, OpenVAS, Burp Suite, and OWASP ZAP for network discovery, vulnerability assessment, web application testing, wireless security, and compliance reporting across diverse environments.

A comprehensive toolkit for professional security engineers. It covers the entire security lifecycle, including systematic threat modeling using STRIDE, designing secure architectures based on Zero Trust and Defense-in-Depth, conducting detailed vulnerability assessments (SAST/DAST), and implementing secure coding practices. Ideal for security audits, compliance reviews, and building resilient systems.

Session Security Guide supplies automated, production-ready assistance for session security checker tasks, offering best practice guidance on authentication, validation, secure coding, and vulnerability detection.

Scans Solana and Anchor programs for six critical security vulnerabilities—arbitrary CPI, improper PDA validation, missing signer/ownership checks, sysvar spoofing, and instruction introspection issues—to support audits and pre-launch reviews.

Execute systematic SQL injection vulnerability assessments on web applications using reconnaissance, payload tuning, and exploitation workflows to uncover database flaws, capture evidence, and validate remediation recommendations for authorized security testing.

Guides SSH service security assessments from discovery, enumeration, credential attacks and key testing to tunneling, vulnerability exploitation, and reporting deliverables.