테스트·보안 스킬

Investigate Next.js security issues across Server Actions, middleware, image optimization, and cached pages. Provides testing workflows for authentication bypass and data exposure, with checks to distinguish actual vulnerabilities from normal responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking authentication in Server Actions and middleware
• Testing image optimization for unintended server requests
• Inspecting page data for sensitive information

Investigate CSRF, where a page causes unwanted actions through a signed-in user's session. The skill covers tokens, cookie settings, JSON APIs, and account linking, with guidance for browser-based demonstrations and assessing account or financial impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review CSRF protection for email changes and payments
• Check whether JSON APIs accept cross-origin form submissions
• Inspect external account linking for unwanted associations

Inspect Android apps for embedded credentials, internal API addresses, and components exposed to other apps. The skill guides APK acquisition, code inspection, and runtime traffic analysis to support a mobile security assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory Android apps included in a security assessment
• Check APKs for embedded credentials and internal API addresses
• Review components that other apps can invoke

Investigate clickjacking, where a hidden page tricks users into unintended clicks. Check protective headers, then verify in a real browser whether the embedded page retains authentication and allows sensitive actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing payment and account settings pages
• Testing OAuth authorization screens
• Checking pages with missing frame protection

Investigate browser-side security flaws in DOM handling, cross-window messages, Service Workers, and CSS. Trace untrusted input to sensitive operations and verify observable impact, helping distinguish reproducible vulnerabilities from harmless signals.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating browser-side script injection
• Reviewing origin checks in cross-window messages
• Verifying data leaks through injected CSS

Investigate file inclusion and path traversal flaws that let applications access unintended files. The skill guides checks for sensitive data exposure and possible code execution, using content evidence or repeatable indirect signals to avoid false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review download and template file paths
• Check whether file reads expose secrets
• Validate file access when content is not displayed

Review access control, authentication flows, and configuration weaknesses across a service. The skill covers invitations, lingering sessions, token permissions, SAML sign-in, and internal APIs, with guidance for comparing response bodies and establishing concrete, reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check identity verification in invitation flows
• Verify access ends after organization membership removal
• Test enforcement of API token permissions

Review API configuration and input handling for unauthorized field updates, prototype pollution that alters shared object defaults, and manipulation of backend URLs. The skill also covers exposed API specifications and access control weaknesses in OData queries.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether profile updates accept privileged fields
• Verifying the effects of prototype pollution
• Inspecting backend URL construction

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review classic ASP.NET Webforms security
• Check exposure of trace and error logs
• Inspect WCF service metadata access

Review multi-factor authentication flows for skipped checks, reused one-time codes, weak backup paths, and verification races. It focuses on proving access to protected resources rather than relying on interface behavior or response codes alone.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access before completing multi-factor authentication
• Test one-time code reuse and validation behavior
• Review backup codes and trusted-device cookies

Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect validation in social login
• Checking state and nonce validation
• Investigating mobile login links

Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking legacy login endpoints left outside SSO controls
• Reviewing token trust between partner and admin portals
• Mapping authentication paths across websites and APIs

Test whether user input becomes HTML markup in pages or notification emails instead of appearing as plain text. Use distinctive test markers to document reflected or stored injection, assess visible effects, and distinguish HTML injection from JavaScript execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check HTML handling in search results
• Inspect stored profile fields and comments
• Review HTML rendering in notification emails

Assess Node.js applications for unsafe input handling and configuration weaknesses. The skill covers prototype pollution, where shared object properties are altered, plus template and command injection, proxy trust issues, and file exposure, with checks for observable impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate prototype pollution in Node.js APIs
• Check Express proxy trust and IP restrictions
• Review template rendering and command execution inputs

Test chatbots and AI agents for injected instructions, data leaks, and unauthorized access across accounts. It emphasizes reproducible evidence, verified external requests, and real data access rather than trusting the model's claims.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Test document-based prompt injection
• Verify data leaks through tools or rendered images
• Check data isolation between accounts

Assess GraphQL APIs in financial services for unauthorized transfers, rounding errors, duplicate transactions, and exposed personal data. The skill guides checks of account permissions and ledger changes to distinguish actual financial impact from misleading success responses.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing transfer and withdrawal permissions
• Checking rounding and duplicate transaction handling
• Inspecting access to identity verification data

Organize a bug bounty investigation from reconnaissance through reporting. The skill helps choose a focused objective, identify the current phase, select relevant techniques and tools, and distinguish reproducible security impact from misleading test results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting objectives at the start of an investigation
• Choosing the next step when testing stalls
• Replanning after switching targets

Assess the storage and retrieval layers of RAG systems, which search documents to support AI answers. Test persistent document poisoning, cross-tenant access, source-text leaks, and manipulated search rankings using independently verifiable evidence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing shared knowledge bases and document chatbots
• Testing access isolation between accounts or organizations
• Checking source text and metadata in search results

Test APIs and forms with unexpected input to uncover error responses that expose internal details. The skill checks response bodies for stack traces, server paths, and library information, preserving specific evidence rather than treating every server error as a vulnerability.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking JSON API error handling
• Testing form and query parameter boundaries
• Identifying internal details in error responses

Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review password reset links and token handling
• Check reauthentication for email and password changes
• Assess takeover risks involving JWT and SSO

Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory exposed gRPC services and methods
• Check authentication and permissions on internal APIs
• Compare identity handling at proxies and backends

Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess permissions granted by discovered cloud credentials
• Review role trust and access across cloud accounts
• Check permissions assigned to anonymous Cognito identities

Test CDN-backed websites for cache poisoning and Web Cache Deception, where private pages are mistakenly cached as public content. The skill guides cache behavior checks, input testing, and independent-client verification to establish reproducible impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing cache behavior on CDN-backed websites
• Checking whether private pages enter public caches
• Verifying cached responses influenced by headers