476 skills · sorted by relevance
Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.
Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.
Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.
Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.
Build a central vulnerability dashboard with DefectDojo to combine scanner findings, remove duplicates, and track remediation. Includes Docker deployment, automated scan imports from CI/CD pipelines, Jira ticket integration, and API queries for reporting metrics.
Build a tracking system for vulnerabilities that cannot be fixed on time. Define exception requests, approval workflows, alternative protective measures, expiration checks, and audit records so teams can track accepted risks and support compliance reviews.
Audit a codebase with three vulnerability hunters and two engineers who build small demonstrations of suspected flaws. Verify attack paths, assess severity from demonstrated impact, and report evidence, targeted fixes, and checks to prevent recurrence.
Build dashboards that show how long vulnerabilities remain unresolved and compare remediation times with severity-based deadlines. Define response policies, automate escalation notices, and report compliance rates and other measures of remediation progress.
Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.
Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.
The English summary is being prepared. Showing the original description.
Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.
The English summary is being prepared. Showing the original description.
Write a vulnerability report. Use when the user says "vulnerability report", "vuln report", "security finding", "write up this finding", "pentest finding", "bug bounty report", "security disclosure", "CVE writeup", "document this vulnerability", "how to report a security issue", or needs to formally document a security vulnerability with evidence, impact, and remediation guidance - even if they don't explicitly say "report".
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.
The English summary is being prepared. Showing the original description.
Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.
The English summary is being prepared. Showing the original description.
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
The English summary is being prepared. Showing the original description.
Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.
Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.
Verify whether a reported vulnerability is fixed in the current code without changing repository files. Trace the original attack path, examine possible bypasses and legitimate behavior, and return an evidence-based verdict for each supplied finding.
Fix a validated or plausible security vulnerability with a focused code change, then verify that the attack no longer works and legitimate behavior remains intact. Report when existing code is safe or essential evidence is missing.
Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.
Get documentation-based help with deepsec, an AI vulnerability scanner. Initialize or resume setup, configure scans and model credentials, and create detection rules or plugins using the documentation bundled with the installed version.