테스트·보안 스킬

Build repeatable evaluations for AI agent responses, tool choices, and multi-step tasks. Use reference datasets and scoring criteria to compare changes, detect quality regressions, and set automated checks that must pass before deployment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare agent quality before and after prompt changes
• Test tool selection and multi-step task execution
• Evaluate resistance to prompt injection

Review pull requests, branches, commit ranges, or local changes with GitNexus. Combine code relationship analysis with source and test inspection to identify concrete defects, missing tests, affected behavior, and risks before merging.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review a pull request before merging
• Trace regressions beyond changed files
• Find missing tests for changed behavior

Understand and extend GitNexus taint analysis, which tracks data from input sources to potentially dangerous operations. Use its implementation guidance to investigate missed or incorrect findings, add detection models, and validate analysis changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating missed or incorrect data-flow findings
• Adding input sources, dangerous operations, or sanitizers
• Reviewing analysis that follows data across functions

Create a disposable Herdr session to reproduce terminal, process, API, or agent issues separately from the main session. Drive tests through the CLI or API, collect evidence of state changes, and clean up the temporary session afterward.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reproducing pane, terminal, or process issues in Herdr
• Checking agent detection and permission-related state changes
• Collecting commands, logs, and state for a reproducible bug report

Check token security audit data before buying or swapping crypto. Review contract and trading risks, buy and sell taxes, and signs of scams such as tokens that can be bought but cannot be sold.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check token risks before a purchase or swap
• Look for tokens that can be bought but not sold
• Review dangerous contract functions and owner controls

Explore a web application as a user to find reproducible bugs and usability problems. Produce a structured report with reproduction steps, screenshots, and videos for interactive issues, giving responsible teams concrete evidence to investigate.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a web app's quality before release
• Testing forms and common user workflows
• Finding confusing interfaces and visual problems

Manage access to a Telegram channel integration by approving pairing codes, updating allowed users, and setting direct-message and group policies. Check pending requests and adjust reply behavior through configuration files read by the channel server.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Approve or deny a Telegram pairing request
• Review and update allowed users
• Change direct-message access policies

Manage access to a Discord channel integration by approving pairing codes, updating allowed users, and setting direct-message and channel policies. Check pending requests and adjust reply behavior through configuration files read by the channel server.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Approve or deny a Discord pairing request
• Review and update allowed users
• Change direct-message access policies

Scan a codebase or selected changes for security issues, then request targeted patch files for findings. Independent agents verify reported issues and proposed fixes, while you review and apply patches yourself.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing an entire repository or a selected area
• Checking security issues in branch or pull request changes
• Scanning a single commit

Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing server-side requests to internal services
• Checking metadata access and token scope
• Distinguishing token extraction from accepted access

Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating access to cloud metadata services
• Tracing instance or workload credentials
• Verifying privileges accepted through metadata credentials

Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting connection setup and authentication data
• Decoding realtime messages and subscription flow
• Tracing reconnect behavior and message order

Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace sign-in redirects and callback parameters
• Inspect state, nonce, and PKCE validation
• Check how tokens become application identity or permissions

Reconstruct frontend behavior from served JavaScript, build manifests, and source maps, which link built code to source. Trace loaded modules, recover route and API references, and identify the smallest asset sequence that explains observed behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reconstructing the structure of served JavaScript
• Recovering route and API references from built assets
• Tracing chunk loading and obscured loader code

Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace an uploaded file to its backend effect
• Investigate archive extraction and preview generation
• Compare visible validation with backend file handling

Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect DPAPI-protected data and masterkeys
• Trace credentials stored by browsers or Windows Vault
• Identify the account or machine context needed for decryption

Trace how requests travel through a CTF sandbox, from hostnames and proxy rules to containers and processes. Compare headers and live traffic to identify which service handles a request and what changes its destination.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify which container handles a request
• Check how Host and forwarded headers affect routing
• Trace path rewrites and WebSocket routing

Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify what triggers forced authentication
• Find which service accepts relayed authentication
• Connect relay acceptance to resulting privileges

Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reproduce bugs triggered by simultaneous requests
• Investigate duplicate actions and ineffective duplicate prevention
• Trace stale reads and gaps in locking

Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace a queued payload to its eventual downstream effect
• Compare request-time settings with worker runtime state
• Investigate retries and dead-letter queue handling

Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Rebuild TCP or UDP communication sessions
• Decode HTTP, DNS, or custom protocol messages
• Recover files transferred over the network

Trace SSH keys, tokens, and other credentials in Linux CTF environments. Connect each recovered artifact to the service that accepts it, then document the resulting privileges or movement to another host.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace where recovered SSH keys and tokens are accepted
• Document privilege gains through sockets or sudo
• Explain movement between Linux challenge hosts

Organize CTF investigations by mapping the supplied targets, tracing one minimal path, and selecting the relevant specialist workflow. Findings are grounded in observed behavior and reproducible evidence, with a clean baseline used for verification.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing an analysis path for a CTF challenge
• Tracing a minimal path through challenge infrastructure
• Packaging reproducible evidence for a solution

Compare GraphQL and RPC contracts, which describe expected API behavior, with generated clients and live handlers in a CTF sandbox. Identify hidden or outdated operations and preserve minimal request pairs that demonstrate the mismatch.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare API contracts with live request handling
• Trace requests made by generated clients
• Investigate hidden or outdated API operations