Skill UI

This skill functions as a specialized dependency security expert. It analyzes project dependencies to identify critical security vulnerabilities, licensing compliance issues, and outdated packages. It provides comprehensive, actionable remediation strategies to strengthen supply chain security.

Automates dependency vulnerability checks within the Security Fundamentals skill set, guiding users through best practices, secure coding patterns, and remediation-ready output validation.

Automates vulnerability scans for applications and APIs via the security-test-scanner plugin, covering OWASP Top 10, SQL injection, XSS, CSRF, authentication, and authorization weaknesses while generating detailed remediation reports.

Automatically runs the vulnerability-scanner plugin to inspect code, dependencies, and configurations, detecting CVEs and insecure settings before releases and delivering detailed reports with remediation guidance.

A specialized skill for conducting comprehensive security audits. It identifies vulnerabilities in code, infrastructure, and dependencies, generating structured reports with severity ratings (CVSS) and detailed remediation guidance. Ideal for SAST scans, penetration testing, DevSecOps pipelines, and compliance checks.

This skill acts as a specialized security expert for analyzing project dependencies. It scans dependencies across multiple ecosystems (e.g., npm, pip, Maven) to identify known vulnerabilities, assess associated risks, and generate Software Bill of Materials (SBOMs). It provides comprehensive insights into supply chain security and offers automated strategies for remediation, ensuring compliance and stability during development.

Execute systematic SQL injection vulnerability assessments on web applications using reconnaissance, payload tuning, and exploitation workflows to uncover database flaws, capture evidence, and validate remediation recommendations for authorized security testing.

Scans FunC-based TON smart contracts for boolean, Jetton, and gas handling vulnerabilities, reporting critical issues with file references and offering remediation guidance for auditors and secure dApp launches.

Automates vulnerability report generation within Security Advanced, guiding users through best practices, compliance checks, and actionable remediation for enterprises.

Establishes a repeatable, structured operational process for managing Microsoft Patch Tuesday security updates. The workflow guides users through advisory review, vulnerability triaging (including zero-days), phased testing, and deployment across major platforms (Windows, Azure, Office). Ideal for maturing patch management programs and defining risk-based remediation SLAs.

This skill provides a comprehensive framework for tracking vulnerability aging and enforcing Service Level Agreements (SLAs). It calculates time-to-remediation against severity-based deadlines (e.g., 14 days for critical), incorporating adaptive modifiers and automated escalation paths. It is essential for establishing compliance policies, measuring remediation efficiency, and managing organizational risk.

DefectDojo is an open-source platform for comprehensive vulnerability management. It aggregates findings from over 200 security scanners (e.g., Nessus, ZAP), automatically deduplicates results, and provides detailed dashboards for tracking remediation progress. It integrates seamlessly with CI/CD pipelines, Jira for ticketing, and Slack for notifications, making it ideal for automated security reporting and compliance tracking in a DevSecOps environment.