487 skills · sorted by relevance
Deploy DefectDojo as a centralized vulnerability management dashboard with scanner integrations, deduplication, metrics tracking, and Jira ticketing workflows.
The English summary is being prepared. Showing the original description.
Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against severity-based timelines and drive accountability.
The English summary is being prepared. Showing the original description.
Find remotely reachable security flaws in repository code and assess whether they warrant a vulnerability report. The workflow checks scope, traces attacker-controlled input, confirms impact with a minimal proof of concept, and structures findings for disclosure.
Coordinate Paperclip vulnerability response from confidential report review and private fixes to local testing, CVE identifier requests, advisory publication, and immediate security releases, with human assistance for reporter communication.
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.
Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.
Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.
Check AI agent skills before installation by inspecting code, instructions, dependencies, and file access without running the code. Receive a PASS, WARN, or FAIL verdict with findings ranked by severity and suggested fixes.
Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.
Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.
Retrieve security findings from Google Cloud Security Command Center for initial assessment. Filter active vulnerabilities, threats, and external exposures, inspect one finding’s full details, or group counts by category to understand the reported risks.
Choose and configure AI tools for Web3 security work across web applications, APIs, and Solidity contracts. Follow setup examples for reconnaissance, vulnerability validation, and proof-of-concept generation, then combine automated findings with manual review.
Use grep text searches to locate Solidity code that needs security review. Ten search groups, priority tiers, and protocol-specific patterns help organize findings and choose where to begin a deeper smart contract audit.
Provides a reference for reviewing DeFi smart contracts, programs that manage blockchain transactions. It organizes vulnerability types with causes, code examples, search patterns, and fixes to help investigate accounting, permissions, boundary conditions, and pricing logic.
Assess Web3 vulnerability findings before submission by checking scope, reproducibility, prerequisites, and attack costs. Organize the root cause, measurable impact, working proof of concept, and proposed fix into an Immunefi report, with examples for comparison.
Examine a DeFi yield aggregator, a protocol that collects investment returns, for missing role assignments and failures caused by tiny rewards. Includes a ten-category review, reproducible test templates, and vulnerability report drafts.
Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.
Run an AI vulnerability scan on uncommitted changes, changes against main, or an entire codebase. Filter candidate files, investigate potential security issues, and review findings with severity ratings, with options to revalidate and export results.
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.
Evaluate older Wi-Fi clients and embedded devices for KRACK and FragAttacks vulnerabilities. Covers test suites, likely patch status, practical impact, and reporting findings by device, firmware version, and vulnerability identifier.