sast-semgrep

This skill uses Spectral to lint and validate API specifications (OpenAPI, AsyncAPI, Arazzo) for security flaws and design issues. It checks against standards like OWASP API Top 10 and allows custom rule creation for governance. Use it to enforce security and design policies directly within your API development and CI/CD pipelines.

This Claude Skill provides an interactive HTTPS proxy for API security testing, enabling traffic interception, modification, and replay across HTTP/1-3 and WebSockets. It includes a Python scripting API for automation and supports multiple interfaces for debugging and testing API communications. Use it for security analysis, modifying requests/responses, and recording traffic for replay or HAR export.

This skill performs fast vulnerability scanning using Nuclei's template-based approach to detect CVEs, OWASP Top 10 issues, and misconfigurations across web apps and APIs. It's ideal for rapid security testing, CI/CD pipeline integration, and scanning multiple targets with customizable severity thresholds. Developers can also create custom templates for organization-specific security patterns.

This Claude Skill performs Software Composition Analysis (SCA) using Synopsys Black Duck to scan dependencies for vulnerabilities, license risks, and supply chain threats. It maps findings to CVE, CWE, and OWASP frameworks and provides remediation guidance. Use it for continuous dependency monitoring in CI/CD pipelines and to assess open-source security and compliance.