스킬 찾기

Write and review YARA-X rules, which identify malware through file patterns. Refine detection strings and conditions, check rule quality with included scripts, test against clean files, improve performance, and migrate rules from legacy YARA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Write rules targeting a specific malware family
• Review false positives and slow detection rules
• Migrate existing YARA rules to YARA-X

Analyze code structure with Trailmark to identify complex functions, trace input flow, assess impact across connected code, and locate privilege boundaries. The resulting JSON provides detailed evidence for deciding where to focus a code audit.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prioritizing code audit targets
• Tracing input flow and assessing impact
• Inspecting unresolved calls and type references

Generates cryptographic test vectors, inputs with expected outcomes, by deliberately changing implementation code and finding changes existing tests miss. Verifies new vectors across independent implementations and compares detection rates before and after adding them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding coverage gaps in cryptographic test vectors
• Creating invalid inputs that exercise validation checks
• Building test vectors shared across independent implementations

Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Running C/C++ fuzzing across multiple CPU cores
• Exploring further after libFuzzer progress stalls
• Monitoring fuzzing progress and stability

Writes and reviews Lean 4 proofs, machine-checked arguments for mathematics or specifications. Follows Mathlib conventions to organize definitions and lemmas, fill proof gaps, refactor lengthy proofs, and establish automated checks for unproved claims and style.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Formalizing mathematics or specifications in Lean 4
• Filling sorry placeholders in proofs
• Splitting long proofs into reusable lemmas

Guides fuzz testing for Ruby libraries and gems with Ruzzy, using varied inputs to find failures. Covers pure Ruby and C extensions, including test harnesses, memory error detection, environment setup, and crash reproduction.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding fuzz tests to a Ruby library
• Testing memory safety in a gem's C extension
• Preparing tracer and harness scripts for pure Ruby

Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding variants of a known vulnerability
• Prioritizing code that shares sensitive operations
• Preparing candidates for Semgrep or CodeQL review

Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Fuzzing a Python package or parser
• Investigating memory corruption in Python C extensions
• Turning raw bytes into typed test arguments

Helps set up and run cargo-fuzz for Rust projects using Cargo. Guides fuzz testing, which tries varied inputs, from writing test harnesses to detecting memory errors, reproducing crashes, and checking which code was exercised.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding fuzz tests to a Rust crate
• Generating structured test inputs
• Testing unsafe blocks or foreign-function calls

Set up OSS-Fuzz for an open-source project and test it locally. Prepare configuration and build files, run fuzz tests that probe code with varied inputs, reproduce reported crashes, and inspect which code the tests reach.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing an open-source project for OSS-Fuzz enrollment
• Testing an OSS-Fuzz build locally before submission
• Reproducing crashes from OSS-Fuzz reports

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Clean up resolved issues left open
• Link issues to pull requests with pending fixes
• Estimate priorities and change sizes for outstanding work

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Writes, reviews, and debugs property-based tests, which generate inputs to check general rules. Helps test conversions, parsers, normalization, and state invariants, assess whether existing assertions are meaningful, and distinguish faulty rules from implementation bugs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing encode/decode round trips across generated inputs
• Checking normalization and sorting properties
• Reviewing whether existing property tests assert meaningful rules

Create an interactive HTML guide to a branch’s code changes, with complete file diffs arranged in a logical reading order, explanations of design choices, and review findings labeled by severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding a branch’s changes in a logical order
• Reviewing diffs alongside design explanations
• Checking findings labeled by severity

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Porting an existing rule to Go or Java
• Checking whether a detection pattern applies to another language
• Creating language-specific detection and safe-code tests

Reviews APIs and configuration designs for choices that make security mistakes easy. Checks unsafe defaults, confusing parameter types, and hidden failures, then validates whether misuse creates a real vulnerability and assigns severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing API designs for security mistakes
• Checking defaults and dangerous configuration combinations
• Assessing cryptographic API usability

Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check an implementation against a specification
• Compare protocol code with a whitepaper
• Verify guarantees stated in a README

Assess test strength by introducing deliberate code changes with mewt or muton. Configure test runs, examine changes that tests miss, distinguish harmless equivalents from testing gaps, and investigate potential bugs in the affected code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up and scope a mutation testing run
• Investigate code changes that tests fail to detect
• Distinguish equivalent changes from testing gaps

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Security checks before an Algorand contract audit
• Reviewing TEAL or PyTeal transaction validation
• Verifying fixes for reported vulnerabilities

Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review StarkNet contracts before launch
• Audit L1-L2 bridge message handling
• Check protection against signature reuse

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks