Results for “security”

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.

The English summary is being prepared. Showing the original description.

Plan and verify security controls for AI agents that read untrusted content and use tools. Review permissions, file boundaries, network destinations, and credentials, then test that rejected actions leave no unintended changes.

• Reviewing security boundaries in an agent runtime
• Checking isolation between tenants and workspaces
• Testing credential cleanup and tool output limits

Review Perl code that handles user input, files, external commands, databases, and web output. Use concrete examples and a security checklist to identify unsafe patterns and apply input validation, parameterized queries, and appropriate output encoding.

• Reviewing user input validation in Perl
• Checking file access and external command execution
• Preventing SQL injection in DBI queries

Review Laravel authentication, permissions, database operations, forms, APIs, and production settings for security weaknesses. Use implementation examples to address unsafe input handling, exposed secrets, session risks, and insufficient access controls.

• Reviewing login and permission controls
• Checking database queries and input validation
• Reviewing forms for forged requests and unsafe scripts

Benchmark security detection systems against 10 known vulnerabilities and nine harmless decoys. Compare four approaches, including an evolved champion, and receive structured JSON covering detection, false alarms, patch tests, reproduction, unsafe outputs, and overall pass or fail.

• Comparing security detection approaches
• Tracking changes in detection and false alarms
• Flagging failed checks in scheduled benchmarks

Review a website’s Content Security Policy, which controls allowed resources, and identify unsafe HTML insertion. Guide policy changes and sanitization, then verify actual HTTP responses and browser behavior in a production-like environment.

• Reviewing an existing Content Security Policy
• Restricting scripts and third-party resources
• Checking how untrusted HTML is rendered

Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.

• Reviewing code and infrastructure security
• Mapping threats with STRIDE or PASTA
• Planning stronger security settings

Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.

• Adding automated security scans to CI/CD
• Creating security rules for project-specific code patterns
• Reducing false alarms and scan time

Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.

• Auditing storage settings across Azure subscriptions
• Investigating publicly accessible blob containers
• Verifying encryption, network, and logging controls

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Deploy Prisma Access to secure access to internal applications for remote users and branches. Configure connectors, GlobalProtect agents, access policies based on user groups and device security, and centralized logging through Strata Cloud Manager.

• Migrating VPN and branch security to Prisma Access
• Restricting internal app access by user and device
• Integrating access controls with existing Palo Alto NGFW systems

Conduct authorized WiFi security assessments covering authentication, encryption, rogue access points, and network separation. Test WPA2/WPA3 configurations and client behavior, then document weaknesses, evidence, business impact, and recommended fixes.

• Assessing corporate, guest, and IoT WiFi security
• Evaluating WPA3 migration and transition mode
• Testing rogue access point detection

Set up repeatable security tests for LLM apps with Promptfoo and DeepTeam. Connect them to automated build pipelines, detect renewed vulnerabilities to malicious instructions or data leakage, and compare results across model or prompt changes.

• Running automated attack tests on every code change
• Blocking merges when security tests fail
• Comparing security across model or prompt versions

Plan authorized voice phishing assessments to evaluate how employees verify callers and report suspicious calls. Organize approved scenarios, record assessment outcomes, and summarize disclosure, verification, and reporting rates to review security awareness training.

• Planning an authorized voice phishing assessment
• Evaluating caller verification and security reporting
• Reviewing the effectiveness of security awareness training

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Audit Terraform infrastructure definitions and planned changes for excessive permissions, public exposure, and missing encryption. Use security scanners and custom rules to produce actionable findings and add automated checks before cloud infrastructure is deployed.

• Reviewing Terraform modules and plans before deployment
• Adding security checks to Terraform CI/CD pipelines
• Enforcing organization-specific infrastructure rules

Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.

• Review security concerns in specific code
• Investigate a suspected vulnerability
• Audit a codebase and produce reports

Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.

• Review SQL, shell commands, and HTML for unsafe input
• Check authentication and access permissions
• Find exposed credentials and sensitive log data

Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.

• Check a web application against the OWASP Top 10
• Test API authentication and access controls
• Scan dependencies and Git history for security risks

Audit game code for save tampering, cheating, network weaknesses, input validation gaps, exposed data, and dependency risks. Produce a report with severity ratings, repair priorities, release recommendations, and explicit notes about areas that could not be assessed.

• Auditing game security before a public release
• Checking risks before enabling online or multiplayer features
• Reviewing save loading and external input handling

Read existing findings, reports, recorded assignments, verification results, and scan status from a connected Codex Security Cloud account. Summarize available evidence and distinguish missing information from confirmed outcomes without changing Cloud data.

• Inspect a finding from its Cloud link
• List findings by severity or recorded assignee
• Review saved validation and patch check reports

Review smart contract security through five steps covering Slither scans, special features, diagrams, documented safety conditions, and manual checks. Get project-specific findings, testing setup guidance, and a prioritized action plan for development or deployment reviews.

• Review smart contract security before deployment
• Triage Slither findings and false positives
• Visualize inheritance and access permissions

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions