alxayo

Use first-pass security scan on unknown/mixed-language codebases, secrets detection (API keys, passwords, tokens), malicious pattern detection (reverse shells, data exfiltration, obfuscation). (2) SECONDARY use supplement language-specific tools with 'secrets' and 'exec' database scans. Key databases secrets (credentials), exec (command injection), sql, xss, plus language-specific. Use for a lightweight Static Application Security Testing (SAST) and rapid source code auditing to identify "sinks" and dangerous functions that could lead to exploits like SQL injection, XSS, and buffer overflows. It is ideal for broad, multi-language security checks. This skill supports auditing for TypeScript, JavaScript, Python, C/C++, Go, Java, .NET/C#, Perl, PHP, Ruby, and SQL. Do NOT use as sole scanner when bandit (Python .py files) or shellcheck (shell .sh files) are applicable—use graudit alongside then.

Comprehensive security scanner for container images, filesystems, Git repositories, Kubernetes, and IaC. (1) Detects known vulnerabilities (CVEs) in OS packages and dependencies. (2) Scans for IaC misconfigurations (Terraform, CloudFormation, Helm, Kubernetes YAML). (3) Detects hardcoded secrets (API keys, passwords, tokens). (4) Identifies license compliance issues. Use for container security, cloud-native security, DevSecOps pipelines, pre-deployment scans. Targets: Docker images, filesystem directories, remote Git repos, Kubernetes clusters, SBOM files. Do NOT use for Python source code vulnerabilities (use bandit), shell script issues (use shellcheck), or malicious package detection (use guarddog).

Security analysis of JavaScript/TypeScript code (.js, .jsx, .ts, .tsx) for vulnerabilities using ESLint with security plugins. (1) Detects code injection (eval, Function), XSS (innerHTML, dangerouslySetInnerHTML), command injection (child_process), ReDoS, path traversal, insecure crypto, prototype pollution. Use for web apps, Node.js services, React/Vue/Angular projects, npm packages, malicious code triage. NOT use for dependency CVEs (use npm audit), non-JavaScript code (use language-specific tools), minified code. For full coverage combine with npm audit or OWASP Dependency-Check for supply chain security.

Scan Infrastructure as Code (IaC) for security misconfigurations and compliance violations using Checkov. (1) Primary use for Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, ARM/Bicep templates, GitHub Actions, GitLab CI, and CI/CD pipelines. (2) Detects cloud misconfigurations, exposed secrets, overly permissive IAM policies, unencrypted storage, public access risks, container security issues. (3) Use for IaC security audits, compliance scanning (CIS, SOC2, HIPAA, PCI-DSS), pre-deployment validation, CI/CD security gates. Do NOT use for application source code vulnerabilities (use bandit, graudit) or dependency/package audits (use guarddog, dependency-check).

Scan project dependencies for known vulnerabilities (CVEs) using OWASP Dependency-Check. (1) Primary use for Software Composition Analysis (SCA) of Java (.jar, .war, .ear), .NET (.dll, .exe, .nupkg), JavaScript (package.json, .js), Python (requirements.txt), Ruby (Gemfile.lock), and Go (go.mod) projects. (2) Detects CVEs from NVD, CISA KEV, OSS Index, RetireJS. (3) Use for dependency audits, CI/CD security gates, compliance scanning, supply chain risk assessment. Do NOT use for source code vulnerabilities (use bandit, graudit) or malicious package detection (use guarddog).

Security audit of Python source code (.py, setup.py, pyproject.toml) for security vulnerabilities using Bandit AST analysis. (1) Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography, OWASP Top 10 Python issues. Use for Python security audits, Django/Flask apps, malicious Python code triage, CI/CD pipelines. NOT use for dependency/package audits (use guarddog), non-Python code (use graudit), shell scripts (use shellcheck). For mixed Python projects, combine with graudit -d secrets for comprehensive coverage.

Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm) ecosystems.ALWAYS use BEFORE running pip install or npm install on untrusted packages.(1) Primary targets requirements.txt, package.json, package-lock.json, *.tar.gz, *.tgz archives.(2) Detects malware, data exfiltration, reverse shells, backdoors, typosquatting, obfuscated payloads, compromised maintainer accounts.(3) Use for dependency audits, pre-installation checks, investigating suspicious packages, supply chain security. Do NOT use for scanning your own source code vulnerabilities (use bandit for Python, graudit for multi-language).

Scan shell scripts for security vulnerabilities using ShellCheck static analysis. Scan files *.sh, *.bash, shell code in Dockerfiles, .github/workflows/*.yml, Makefiles, npm scripts. (1) Detects command injection, arbitrary code execution, reverse shell patterns, data exfiltration, obfuscated payloads (base64/hex), unsafe rm operations, dangerous PATH manipulation. (2) Use for standalone scripts, CI/CD pipelines, installation scripts,build systems. For shell scripts containing embedded Python/other code, also run language-specific scanners. Combine with graudit -d exec for patterns ShellCheck may miss (e.g., base64 | bash).

Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.

Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.

Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.

Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.

Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.

Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.

Use when refactoring ADO.NET DataSet/DataTable/DataRow code into typed C# DTOs and safe parameterized queries using Dapper (or parameterized SqlCommand). Focuses on minimal risk and incremental cutover, one query at a time.

Use this skill specifically for the custom expression evaluation / data transformation module in the VB codebase. This module acts as a business-rules engine and requires extreme care: golden-master tests MUST be in place before any extraction begins. Do not use the generic extractor skill for this module.

Use when wrapping the legacy SOAP web service behind an ILegacyApi interface boundary. Enables testing and future replacement. Produces the interface, real adapter, test fake, and contract tests. SOAP is an external fixed contract — we adapt to it, not change it.

Use this skill to capture the current behavior of an ASP.NET WebForms workflow before any refactoring begins. Produces Playwright E2E tests and/or golden-master approval tests that act as the migration oracle. Invoke before extracting business logic from any VB event handler.