blackduck-inc

Comprehensive code explanation skill that analyzes and explains the Black Duck Security Scan codebase architecture, execution flow, data flow, design patterns, and component relationships. Use when users ask "how does this work", "explain the architecture", "trace the execution", or "what patterns are used".

Comprehensive code generation skill that generates new TypeScript components, modules, services, utilities, tests, and documentation following Black Duck Security Scan codebase patterns and best practices. Ensures type safety, proper error handling, consistent code style, and comprehensive test coverage.

Comprehensive code review skill that analyzes code quality across linting/formatting, type safety, error handling, refactoring opportunities, testing quality, design patterns, and documentation. Use for thorough code quality analysis. For security-specific reviews, use the security-review skill instead.

Comprehensive security review skill that analyzes code for security vulnerabilities and best practices including input validation, injection prevention, secret handling, unsafe operations, path traversal, authentication, and OWASP Top 10 compliance. Use when performing security-focused code reviews.

Analyzes implementation requirements for new features in the Black Duck Security Scan codebase. Reads the codebase, maps every file that must change, identifies breakage risks, dependencies, and writes a structured implementation plan with prioritized changes and risk assessment. Use when planning feature implementations or analyzing impact of proposed changes.

Use when asked to explain how any part of the Black Duck Security Scan ADO extension works — entry flow, product scan setup, Bridge CLI integration, input handling, PR comments, Fix PRs, SARIF upload, airgap mode, proxy/SSL, or version compatibility. Produces a precise, file-linked explanation grounded in the actual source.

Use when implementing any new task in the Black Duck Security Scan ADO extension — adding a product, adding/deprecating a parameter, adding Classic UI support, writing unit tests, upgrading dependencies, upgrading Node.js version, or any other extension feature work. Produces complete, file-accurate implementation steps grounded in existing patterns.

Use when reviewing changes to the Black Duck Security Scan ADO extension. Checks coding standards, established patterns, and backward compatibility — covering input handling, version-gated behavior, Classic Editor parity, error construction, HTTP client usage, task.json integrity, and test coverage. Flags deviations with file:line citations and prescribes the correct pattern.

Use when doing a security review of the Black Duck Security Scan ADO extension. Covers SAST-level checks specific to this codebase — secret/credential logging, command injection, path traversal, TLS bypass, insecure HTTP clients, token leakage in files, proxy credential exposure, input injection into JSON payloads, and ADO pipeline variable security. Produces findings with file:line citations and remediation steps.

Use when asked to analyze what changes are needed to implement a new feature in the Black Duck Security Scan ADO extension. Reads the codebase, maps every file that must change, identifies breakage risks, and writes a structured changes.md file with a prioritized change plan and risk table. Trigger on "analyze this feature", "what needs to change for X", "plan this implementation", "impact analysis for X".