Secure Coding Agent Skills

Deploys passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks.

Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.

Guides through implementing application whitelisting on Windows using AppLocker, from inventory and rule creation to audit-mode deployment and enforcement.

Configure and deploy Palo Alto Networks next-generation firewalls with App-ID, User-ID, zone-based policies, SSL decryption, and threat prevention profiles for enterprise network security.

Implements Schnorr identification protocol and zero-knowledge password proof for authentication where the server never learns the user's password.

Automates security scanning for Infrastructure as Code templates using Checkov, tfsec, and KICS to detect misconfigurations before deployment.

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC-based signing, attestations, and Kubernetes admission enforcement.

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.

Reduce container attack surface by building application images on Google distroless base images that contain only the application runtime with no shell, package manager, or unnecessary OS utilities.

Develops custom WordPress themes and plugins, creates Gutenberg blocks, configures WooCommerce stores, implements REST API endpoints, and applies security hardening with nonces, sanitization, escaping, and capability checks.

Build high-performance async Python APIs with FastAPI and Pydantic V2, including REST endpoints, authentication, async database operations, and WebSocket support.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Add programmable safety guardrails to LLM applications at runtime, including jailbreak detection, input/output validation, fact-checking, hallucination detection, PII filtering, and toxicity detection.

Finds exploitable vulnerabilities in codebases through a structured multi-phase audit covering recon, hunting, validation, and reporting.

Orchestrates Gemini 3 Flash to audit Linux Kernel patches for memory safety, detect cost drifts in Terraform plans, and generate hardened Kubernetes security contexts.

Validates Claude Ads contracts, bundles, scores, runs, capabilities, repositories, and releases with deterministic checks and recovery steps.

Scans installed or specified agent skills for advertising, covert commercial intent, task hijacking, suspicious external calls, and sensitive-data access. Reports findings first and quarantines only after explicit user confirmation.

Provides a command-line workflow for binary analysis with radare2, covering reconnaissance, disassembly, function analysis, string and import inspection, patching, binary diffing, and r2pipe scripting across PE, ELF, Mach-O, DEX, and WASM formats.

Engineers reliable exploits from known vulnerabilities in binaries, covering stack overflows, heap exploitation, and kernel pwn with remote stabilization techniques.

Provides a structured CLI workflow for Android APK reverse engineering, covering decompilation with jadx and apktool, smali modification, repackaging, signing, and Frida dynamic hooking, with optional native .so analysis via IDA or radare2.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Provides a structured methodology for authorized Android and iOS reverse engineering, covering static analysis, dynamic instrumentation with Frida and Objection, SSL pinning bypass, root/jailbreak detection evasion, and cryptographic key extraction.

End-to-end firmware and IoT penetration testing pipeline following OWASP FSTM methodology. Extracts, emulates, and exploits router, camera, and smart-home firmware using binwalk, EMBA, Firmadyne, and AFL++.

Guides authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot assessment, and offline firmware extraction support.

Provides structured reverse engineering techniques for analyzing compiled, obfuscated, packed, or virtualized targets including binaries, APKs, WASM, firmware, and custom VMs using static and dynamic analysis workflows.

Generates custom Semgrep rules from natural language descriptions of vulnerability patterns, verifying syntax with semgrep --validate and testing against sample fixtures with semgrep --test.

Runs Semgrep static analysis with custom YAML rules, supporting taint tracking, metavariable comparisons, and pattern-not-inside exclusions for precise vulnerability detection.

Runs Semgrep static analysis via the semgrep CLI with custom YAML rule packs, supports community rules, parses JSON output, and integrates with the Semgrep App API for findings management.

Runs a deep cross-layer consistency audit across a codebase, tracing features from UI to database to find broken wiring, missing handlers, model mismatches, and security gaps, then auto-fixes critical and warning issues.

Performs a static-analysis penetration test to find exploitable vulnerabilities, providing proof-of-concept payloads and fixes. Covers injection, XSS, authentication bypass, authorization flaws, path traversal, command injection, CSRF, SSRF, hardcoded secrets, and insecure deserialization, with a full attack surface.

Prevents SOQL injection and enforces CRUD, FLS, and sharing in Apex queries, with guidance for building, reviewing, and troubleshooting secure data access.

Guides setting up and using Atheris for coverage-guided fuzzing of Python code and C extensions, including Docker setup, harness writing, and corpus management.

Runs Semgrep static analysis to find bugs and security vulnerabilities, with guidance on installation, rule selection, custom rule writing, and CI/CD integration.

Guides backend development across API design, authentication, databases, performance, security, scalability, and testing, with quick decision guides and defaults for production-ready systems.