679 skills · sorted by relevance
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
Review web application security across user input, authentication, external services, dependencies, personal data, and AI features. Identify threats, apply protective controls, and verify changes with checks covering access permissions, sensitive information, and untrusted model output.
Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.
Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.
Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.
Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.
The English summary is being prepared. Showing the original description.
Find remotely reachable security flaws in repository code and assess whether they warrant a vulnerability report. The workflow checks scope, traces attacker-controlled input, confirms impact with a minimal proof of concept, and structures findings for disclosure.
Retrieve current cyber threat data, including malware indicators, addresses of attacker control servers, and vulnerabilities known to be exploited. Filter by threat type, source, severity, and date to identify relevant threats for review and reporting.
Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.
Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.
Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.
Retrieve security findings from Google Cloud Security Command Center for initial assessment. Filter active vulnerabilities, threats, and external exposures, inspect one finding’s full details, or group counts by category to understand the reported risks.
Review source code, dependencies, and infrastructure settings for security issues. Find exposed credentials, unsafe input handling, and access control gaps, then organize findings into a report with severity levels, affected locations, and recommended fixes.
Review pull requests, commits, branch differences, or local patches for security vulnerabilities. Inspect changed and deleted text files, trace relevant supporting code, and return validated findings, review comments, and a report describing coverage gaps.
Review pull requests, commits, or local changes for security vulnerabilities, including deleted files. Validate potential issues, trace how attacks could reach them, and produce a report showing confirmed findings and gaps in review coverage.
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
The English summary is being prepared. Showing the original description.
Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did the security scan find", remediating or triaging security risks, or wants to start fixing reported vulnerabilities — even if they don't name the service explicitly. Trigger it for phrases like "get my security findings", "what vulnerabilities do we have", "let's fix the pentest results", or "triage the security report". The skill discovers scans, exports findings to a gitignored local directory (so sensitive exploit detail is never committed), produces a prioritized triage summary, and offers to start fixing the highest-risk issues.
The English summary is being prepared. Showing the original description.
Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm vulnerabilities, ai generated code review, owasp llm, secure ai development, security, ai, llm, owasp, code-review, vulnerabilities" mentioned.
The English summary is being prepared. Showing the original description.
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
The English summary is being prepared. Showing the original description.
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
The English summary is being prepared. Showing the original description.
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
The English summary is being prepared. Showing the original description.
Implement and review security measures in Quarkus applications. Covers sign-in, access permissions, input validation, password hashing, secret storage, request limits, audit logs, and checks for known vulnerabilities in dependencies, with implementation and configuration examples.
Check a Django application before a pull request or deployment. Review its environment, code quality, database changes, tests, vulnerabilities, and configuration, then produce a phased pass/fail report identifying issues that need fixes.