fabioc-aloha/Alex_Skill_Mall - Page 8

critical-thinking

Challenge what you think is right — alternative hypotheses, missing data, evidence quality, bias detection, falsifiability, and adversarial review

debugging-patterns

Systematic problem-solving and error analysis.

dialog-engineering

CSAR Loop and structured conversation patterns for effective AI dialog -- Clarify, Summarize, Act, Reflect

hypothesis-driven-debugging

Investigate build failures, test errors, runtime crashes, or unexpected behavior through systematic minimal reproduction, multi-hypothesis testing, and evidence-based verification. Use when asked to "debug", "investigate a failure", "find root cause",…

knowledge-synthesis

Cross-project pattern recognition — abstract, generalize, connect, store at the highest true level

problem-framing-audit

Step-back protocol — restate, generalise, specialise, invert, ask why, pre-mortem, check stakeholders, and audit framings before solving

root-cause-analysis

Find the true source, not symptoms — systematic debugging from observation to permanent fix

rubber-duck-debugging

Be a thinking partner. The answer often emerges when explaining the problem.

socratic-questioning

Help users discover answers, don't just deliver them.

allowlist-over-blocklist

Validate input against an allowlist of permitted values — reject everything else

api-security-hardening

API security hardening — rate limiting, JWT validation, CORS, input validation (4-layer defense)

assist-sg-update

Generate assisted PRs to correct Security Group ownership for first-party apps flagged by S360 tenant-isolation policy (SFI-TI3.2.2)

build-fix

Fix compile-time and build errors introduced by prior agent changes

create-associate-nsg

Creates a new Network Security Group and associates it with the specified subnets and/or NICs of a Virtual Network.

distribution-security

Defense-in-depth, PII protection, secrets scanning, and secure packaging for distributed software

error-message-sanitization

Raw error messages leak internal information to users:

fetch-violations

Query S360 Kusto for SFI-TI3.2.2 tenant isolation violations, classify by ViolationTitle, flag autofix-eligible items for downstream remediation

generate-report

Generate an interactive, self-contained HTML dashboard displaying SFI-TI3.2.2 tenant isolation violations for a service, org, or alias -- includes filtering, sorting, severity coding, TSG links, S360 deep links.

guide-advanced-remediation

Complex multi-step remediation scenarios for S360 Tenant Isolation violations that require code changes, Federated Identity Credential (FIC) setup, and bilateral coordination between service teams.

guide-cert-rehoming

End-to-end process of rehoming (moving or reissuing) certificates so every production Entra app credential lives in the same tenant and cloud as the app itself.

input

Extract and resolve required CodeQL alert metadata from user input before remediation

lookup-nsg-for-vnet

Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage.

lookup-nsg

Finds the Network Interface Card (NIC) and associated Network Security Group (NSG) for a VM given its public IP address.

markdown-sanitization-chain

Markdown sanitization order matters — marked.js then DOMPurify then Mermaid to prevent XSS

nnf-cve-cleanup

Cleans up NNF deployments impacted by vulnerable or outdated container images using guided execution.

output

Produce the final CodeQL fix result table and choose the correct exit code and retry behavior

path-traversal-prevention

When copying files or serving content, user-controlled paths can escape the intended directory:

pii-privacy-regulations

Handling personally identifiable information under European and Australian privacy regulations.

privacy-responsible-ai

Privacy by design, data protection, and responsible AI principles.

remediate-nsg

Applies M365NetIsoNsg compliance rules to an existing Azure NSG and outputs the ARM template for Safe Deployment.

remediate-pfx-certificates

Skill helps user to remove checked-in certificates from source code in case of exposed secrets

revoke-and-rotate-certificate

Skill helps user to revoke and rotate certificate in case of exposed secrets

secrets-management

Secure token storage, VS Code SecretStorage API, credential management, environment variable migration

security-review

Defend before attackers find the gaps - OWASP, STRIDE, and Microsoft SFI

security-threat-modeler

Analyze codebase architecture to generate a STRIDE-based threat model with data flow diagrams, trust boundaries, prioritized threats, and mitigations. Compatible with Microsoft Threat Modeling Tool concepts. Use when asked to "threat model", "security…

shell-injection-prevention

Use execFileSync with args array instead of execSync with string concatenation to prevent shell injection

symfix

Classify and remediate CodeQL alerts with the SymFix workflow using staged changelog updates

threat-surface-analysis

Discover a codebase's threat surface through systematic investigation — map ecosystem groups, dependency graphs, service connections, authentication mechanisms, and trust boundaries. Use when performing threat modeling, security review, or architectural…

violation-triager

Orchestrate end-to-end SFI-TI3.2.2 workflow — fetch violations, classify, dispatch to remediation skills, generate report

coherence-audit

Detect coherence violations between Alex_ACT_Edition (brain) and Alex_Skill_Mall (marketplace) — broken references, tag mismatches, deprecated install snippets