682 skills · sorted by relevance
Check a Django application before a pull request or deployment. Review its environment, code quality, database changes, tests, vulnerabilities, and configuration, then produce a phased pass/fail report identifying issues that need fixes.
Test an authorized web application, map its exposed pages and inputs, and verify suspected vulnerabilities with reproducible evidence. Produce a security report covering confirmed findings, their impact, reproduction steps, and suggested fixes.
Audit project dependencies for known vulnerabilities and outdated packages. Organize findings by severity, review proposed package changes before optional automatic fixes, and rerun the audit to check whether the reported vulnerability count decreased.
Set up Strix security checks in CI/CD to test pull request changes, report verified vulnerabilities, and gate merges. Covers both a CLI running on your own infrastructure and a managed service with pull request comments.
Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.
Review pending code changes for newly introduced security vulnerabilities with clear exploitation paths. Focus on concrete, significant risks and filter likely false alarms, then report affected files, line numbers, severity, attack scenarios, and recommended fixes in Markdown.
Analyze firmware from routers, cameras, and other IoT devices, from extracting internal files to running services in an emulator. Follow a staged workflow to investigate vulnerabilities and reproduce findings with firmware analysis and testing tools.
Review and write Solidity smart contracts with security in mind. Address reentrancy, where external calls trigger repeated execution, along with numeric overflow and access control issues, using implementation patterns, security tests, and documentation for audit preparation.
Review concrete code for exploitable security defects, including missing access checks, unsafe input handling, and exposed secrets. Report verified issues with file locations, reachable attack paths, severity, and suggested fixes.
Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.
Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.
Assess iOS and Android app security using OWASP MASTG, a mobile security testing guide. Examine app files, runtime behavior, stored data, authentication, and API traffic, then document vulnerabilities, their impact, and suggested fixes.
Assess cybersecurity risks using NIST SP 800-30 Rev 1 by examining threats, weaknesses, likelihood, and business impact. Produce a ranked risk register, a structured record of risks and recommended responses, with a summary for leadership.
Build a repeatable process for Microsoft monthly security updates, from reviewing advisories and ranking vulnerabilities to testing, staged deployment, and verification. Helps teams set response deadlines based on risk and report remaining unpatched systems.
Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.
Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.
Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.
Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.
Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.
Review websites for security, browser compatibility, and code quality. Identify issues in HTTPS settings, third-party libraries, HTML, and error handling, then apply concrete improvements using checklists and implementation examples.
Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.
Helps address Google Cloud Security Command Center findings by planning targeted fixes for permissions, misconfigurations, vulnerabilities, and combined attack paths. It includes impact checks, verification, rollback steps, and execution after user approval.
Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.
Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.