38 skills · sorted by relevance
Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns
The English summary is being prepared. Showing the original description.
安全报告输出时使用。适用于安全评审报告 / 漏洞汇总 / 风险等级 / 修复跟踪。融合 CVSS 评分 + 修复建议 + 验证确认。
The English summary is being prepared. Showing the original description.
Validate a bug bounty finding before writing a report — the 7-Question Gate, 4 pre-submission gates, always-rejected list, conditional chain table, CVSS 3.1 quick reference, and severity decision guide. Use BEFORE writing any report to avoid N/A and low quality submissions.
The English summary is being prepared. Showing the original description.
Write production-grade HackerOne reports — title formula, impact-led writing, CVSS 3.1 scoring, complete PoC formatting, attached files, and submission etiquette. Use AFTER triage-validation passes and you're ready to submit on HackerOne.
The English summary is being prepared. Showing the original description.
Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
The English summary is being prepared. Showing the original description.
Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".
The English summary is being prepared. Showing the original description.
Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat modeling at design time rather than deferring security review to the end, triaging a dependency vulnerability by actual reachability rather than CVSS score alone, combining SAST/DAST/SCA tooling to cover their distinct blind spots, or applying context-specific output encoding to untrusted input. Distinct from an information security analyst — this role works inside the SDLC to prevent vulnerabilities before they ship, not detect and respond to intrusions in production.
The English summary is being prepared. Showing the original description.
Checks outdated packages, unused deps, reinvented wheels, vulnerability scan (CVE/CVSS). Supports mode: full | vulnerabilities_only.
The English summary is being prepared. Showing the original description.
Correlate scanner results with CVE and exploit intelligence and prioritize by CVSS and exploitability.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use 'could potentially' — prove it or don't report.
The English summary is being prepared. Showing the original description.
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
The English summary is being prepared. Showing the original description.