'security' 검색 결과

Implement application security controls, including login, access permissions, password hashing, and input validation. The skill provides code, configuration requirements, and testing guidance for checking protections against unauthorized access, malicious input, and sensitive data exposure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implementing login with password hashing and rate limits
• Adding JWT validation and session protection
• Preventing SQL injection and malicious script execution

Review code changes and files for bugs, security risks, performance problems, design issues, and test coverage. Receive a structured report with prioritized findings, concrete improvement examples, positive feedback, and an overall review verdict.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a pull request
• Auditing code quality and security
• Finding refactoring opportunities

Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Turning vulnerability notes into a disclosure report
• Checking source code and proof-of-concept claims
• Preparing separate reports for multiple vulnerabilities

Inspect repository code or code changes for plausible security vulnerabilities. The skill records candidate issues with affected locations, attacker-controlled inputs, failing safeguards, and possible impact, preserving the evidence needed for later validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding security issues that may arise from code changes
• Investigating vulnerability candidates in repository code
• Organizing source evidence for later validation

Fix a validated or plausible security vulnerability with a focused code change, then verify that the attack no longer works and legitimate behavior remains intact. Report when existing code is safe or essential evidence is missing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Fix a reported vulnerability and verify the result
• Check for alternate inputs that bypass a proposed fix
• Confirm that a security patch preserves legitimate behavior

Review code or changes for exposed secrets, injection risks, weak encryption, and missing permission checks. Produce a structured report with severity, location, recommendations, and confidence, with a separate reviewer checking findings for false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a module for security issues
• Checking changes for exposed secrets
• Preparing a vulnerability report with evidence

Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review security concerns in specific code
• Investigate a suspected vulnerability
• Audit a codebase and produce reports

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Assess Z-Wave smart home security by examining captured traffic, distinguishing S0 and S2 security schemes, and reviewing authentication, key exchange, and hub weaknesses. Organize findings by device, firmware, and security mode.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Z-Wave smart home device security
• Mapping S0 and S2 security modes across devices
• Planning traffic capture during device pairing

Examines code or code changes for plausible security vulnerabilities by tracing attacker-controlled input to dangerous operations or failed safeguards. Records candidate issues with affected locations, supporting evidence, potential impact, and controls that need further validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discover candidate vulnerabilities in code changes
• Trace input paths to authorization gaps or injection risks
• Investigate code locations linked to a security advisory

Create a Markdown threat model grounded in a codebase. Identify valuable assets, boundaries between trusted and untrusted components, realistic attack paths, and mitigations, then prioritize risks using explicit assumptions about likelihood and impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map attack paths across a codebase
• Assess threats within a specific project directory
• Prioritize risks to data and credentials

Review web code for security, browser compatibility, and code quality. Covers HTTPS, dependency vulnerabilities, security headers, outdated APIs, HTML structure, error handling, and cleanup of event listeners, with examples and audit checklists to guide improvements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review HTTPS, security headers, and cookies
• Check dependencies and handling of user input
• Replace outdated APIs and improve browser compatibility

Review and implement gh-aw workflows and Go code with security checks for untrusted input, shell commands, dependency versions, and permissions. The skill also covers event-specific conditions and tools that inspect workflows for errors and security risks without running them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing issue and PR input handling for injection risks
• Checking conditions in workflows with multiple event triggers
• Reviewing action version pins and job permissions

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "DOCA Argus" by name — typical implicit phrasings: "container green but no findings arrive", "false-positive flood in Splunk", or "runtime security on a fleet of BlueField-3s". Refuse and route elsewhere for installing DOCA, SIEM-side ingest stanzas, pre-baked detection-rule packs, and metrics observability (DOCA Telemetry). Argus is NVIDIA's currently- promoted runtime-security framework, superseding the older App Shield library; name it first for new runtime-security work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

[omh] Security event on the code already shipped -- a CVE in a dependency, a secret committed to the repo, a license question, an advisory: triage reachability and severity, contain in order, and never close a leaked secret before its rotation is observed. Use when the user says: security-event-response, security event response, cve, triage this cve, cve in our dependency, cve in a dependency, security advisory, dependabot alert.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security scan or review, check security issues, check scan status, show findings, list recent scans, or stop a scan.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket. Use when the user asks to "set up security agent", "configure security scanner", "is security agent configured", or on first-time use before any scan or pentest.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit wallet security by analyzing token approvals, permissions, and transaction patterns. Use when checking wallet security, reviewing approvals, or assessing risk exposure. Trigger with phrases like "audit wallet", "check approvals", "security scan", or "revoke tokens".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.