46 skills · sorted by relevance
Turn validated vulnerabilities into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Platform templates help organize demonstrated impact, reproducible steps, supporting evidence, severity reasoning, and concrete fixes in language reviewers can follow.
Scaffold a standalone RTVI CV microservice that plugs into VSS Search and Alerts profiles via Kafka mdx-raw. The shipped scaffold script is a YOLO26 reference implementation (ONNX, labels, custom parser required). Use when building a new perception microservice repo, validating the VSS integration contract, extending that scaffold for segmentation frame-mask payloads, or scaffolding with placeholders before customer YOLO26 assets exist. For swapping the detector in the stock vss-rt-cv container, use rtvi-cv-customize-model instead. Live DeepStream integration cannot run until the customer-supplied ONNX, labels file, and parser library exist.
The English summary is being prepared. Showing the original description.
Turn penetration test and red team results into reports for executives and technical teams. Structure findings, explain severity scores and business impact, organize evidence, and document remediation steps and retest plans.
Turn validated security findings into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Provides templates, reproducible evidence structure, severity scoring guidance, and submission checks focused on demonstrated impact.
Evaluate security findings before writing a bug bounty report. Check reproducibility, scope, practical impact, duplicates, and behavior across user sessions, then use submission checklists and CVSS 3.1 guidance to prepare evidence and assess severity.
Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.
Review vulnerability findings before drafting a bug bounty report. Seven validation questions and submission checklists help assess scope, reproducibility, demonstrated impact, duplicate reports, and whether the claimed severity matches the available evidence.
How to swap the VLM in the VSS Alerts Blueprint — covers RTVI-VLM microservice deployment methods, all three VLM consumers (rtvi-vlm, vlm-as-verifier, vss-agent), and health checks.
The English summary is being prepared. Showing the original description.
Extract CVSS (Common Vulnerability Scoring System) scores from vulnerability data sources with proper fallback handling. This skill covers understanding CVSS v3, handling multiple score sources (NVD, GHSA, RedHat), implementing source priority logic, and dealing with missing scores in security reporting.
The English summary is being prepared. Showing the original description.
Synthesized reference notes from three US Government vehicle-safety sources: NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (updated 2022, final), NHTSA Automated Driving Systems 2.0: A Vision for Safety (2017), and a 16-section selection of 49 CFR Part 571 (FMVSS) pinned at eCFR versioner date 2025-01-01. Use for voluntary vehicle cybersecurity practices, the ADS 2.0 twelve priority safety design elements, and FMVSS occupant protection, brakes/stability/lighting, and fuel/EV integrity requirements. Not ISO 26262, not ASPICE, not ISO/SAE 21434, not UNECE R155/R156, not SAE J3016, and not the full Part 571; the FMVSS material is a selection of vehicle-level minimum performance standards, not a process standard.
The English summary is being prepared. Showing the original description.
How to swap the DeepStream CV detection model in the VSS Alerts Blueprint verification (2d_cv) mode - covers ONNX export, custom bbox parsers, compose mount gotchas, nvinfer config, runtime TRT engine build, deployment, and a segmentation-capable model addendum handoff.
The English summary is being prepared. Showing the original description.
Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting
The English summary is being prepared. Showing the original description.
Writes professional bug bounty reports for HackerOne, Bugcrowd, and Intigriti with CVSS 4.0 scoring, business impact, working exploits, and remediation. Runs 5-check Pre-Report Verification first: hallucination detection, AI writing patterns, PoC reproducibility, duplicate detection, and impact plausibility. Use when user describes a vulnerability, shares HTTP logs, HAR files, recon output, or screenshots; says 'write a bug report', 'format my finding', 'draft a vuln report', 'is this valid', 'rate my vulnerability', 'verify my report', or any variant. Trigger for partial or messy input — raw notes, one-liners, or full writeups all work. Do not wait for perfect input.
The English summary is being prepared. Showing the original description.
Expert en bug bounty (HackerOne, Bugcrowd, scope, PII, CVSS scoring, responsible disclosure)
The English summary is being prepared. Showing the original description.
Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.
The English summary is being prepared. Showing the original description.
Audit a codebase with three vulnerability hunters and two engineers who build small demonstrations of suspected flaws. Verify attack paths, assess severity from demonstrated impact, and report evidence, targeted fixes, and checks to prevent recurrence.
Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.
Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.
Find skills for tasks involving NVIDIA products or GPU computing using the live catalog. Get up to three relevant recommendations, with reasons, installation commands, and starter prompts; installation requires explicit approval.
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.
The English summary is being prepared. Showing the original description.