'injection' 검색 결과

Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing workflow inputs and execution triggers
• Assessing pipeline permissions and credential exposure
• Checking build artifact handoffs for tampering risks

Investigate LDAP and XPath injection in directory searches and XML-backed authentication. The skill guides checks for login bypasses and information leaks, uses control responses to reduce false positives, and distinguishes Active Directory from other LDAP directories.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing directory-backed corporate login
• Testing employee and address-book searches
• Checking authentication backed by XML data

Investigate browser-side security flaws in DOM handling, cross-window messages, Service Workers, and CSS. Trace untrusted input to sensitive operations and verify observable impact, helping distinguish reproducible vulnerabilities from harmless signals.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating browser-side script injection
• Reviewing origin checks in cross-window messages
• Verifying data leaks through injected CSS

Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing suspected SQL injection in an authorized web application
• Inspecting database, table, and column structures
• Testing POST requests captured with Burp Suite

Comprehensive guide for dependency injection (DI) in Golang. Covers why DI matters (testability, loose coupling, separation of concerns, lifecycle management), manual constructor injection, and DI library comparison (google/wire, uber-go/dig, uber-go/fx, samber/do). Use this skill when designing service architecture, setting up dependency injection, refactoring tightly coupled code, managing singletons or service factories, or when the user asks about inversion of control, service containers, or wiring dependencies in Go. For a specific DI library, → See `samber/cc-skills-golang@golang-google-wire`, `samber/cc-skills-golang@golang-uber-dig`, `samber/cc-skills-golang@golang-uber-fx`, or `samber/cc-skills-golang@golang-samber-do` skills.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Plans, builds, runs, and analyzes fault injection experiments with AWS Fault Injection Service (AWS FIS) to validate application resilience through chaos engineering. Covers experiment templates (actions, targets, stop conditions), the FIS actions catalog and action selection, the scenario library (AZ power interruption, cross-Region connectivity, EC2/EKS/EBS stress), experiment lifecycle and monitoring, logging and reports, multi-account experiments, the experiment IAM role, and blast-radius safety. Applies when a user mentions AWS FIS or fault injection, asks what experiment to run for a failure mode (AZ, Region, API errors/throttling, instance/pod/DB/cache failure, latency, packet loss), wants to author an experiment template or CLI/CloudFormation, or needs to safely run chaos experiments in pre-production or production. For the broader resilience program across Resilience Hub and ARC, see aws-resilience-lifecycle; for ARC routing controls and zonal shift, see recovery-controller-setup.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects prompt injection hidden in documents from the other side (pleadings, skeletons, bundles, served evidence, opponents' emails and attachments) before an AI reads them, so the model is not turned against your client. Checks word by word that the text an extractor hands the model was visibly drawn on the page: white, near-white, covered, clipped, off-page, tiny, transparent and invisible-mode text in PDF (ink test plus OCR); Word formatting resolved as Word does (styles, shading, theme colours, scaling, off-page frames, fallbacks, unused headers); HTML/CSS, RTF, email with attachments and zips, xlsx/pptx and legacy formats. Flags Unicode smuggling, text addressed to an AI and authorities found only in hidden text. Fails closed. Optional Read-tool hook. Use BEFORE any AI summary or analysis of an opposing or third-party document. Triggers: 'scan for injection', 'is this document safe', 'check the other side's skeleton', 'injection guard'.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit applications for AI prompt injection, agent security, and LLM permission boundary vulnerabilities. Use when the user mentions 'prompt injection,' 'LLM security,' 'AI security,' 'jailbreak,' 'indirect prompt injection,' 'prompt leaking,' 'AI red team,' 'LLM vulnerabilities,' 'AI input validation,' 'system prompt extraction,' 'agent security,' 'MCP security,' 'AI permissions,' 'AI privilege escalation,' or needs to secure any application with AI features, AI agents, or LLM integrations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert guide for defending AI applications against prompt injection, jailbreak attacks, indirect injection via tool outputs, and data exfiltration through tool calls — input sanitization, output filtering, canary token detection, and layered defense architecture / Panduan ahli pertahanan aplikasi AI terhadap prompt injection, serangan jailbreak, injeksi tidak langsung via output tool, dan eksfiltrasi data melalui tool calls — sanitasi input, filtering output, deteksi canary token, dan arsitektur pertahanan berlapis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit AI applications using Indirect Prompt Injection. This skill focuses on hiding malicious instructions within data sources (web pages, documents, emails) that the LLM processes, causing the AI to execute unintended actions or leak data without direct user interaction.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing legitimate user requests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects process injection in a memory image by identifying private executable regions with no file backing, RWX protections, and modified entry points using Volatility 3 malfind-style analysis. Activates for requests to detect process injection, find injected code in memory, or triage suspicious executable regions in a memory image.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Opt-in DI architecture using Reflex for Unity 6+. Covers container setup, scoping, injection, command pattern, update management, and class taxonomy. Use when ProjectConfig.yaml -> architecture_pattern is "di-first", or when the user asks about dependency injection, inversion of control, service architecture, or testable game code. Triggers on "set up DI", "add dependency injection", "create a service", "wire up dependencies", "make this testable", "decouple these systems", "add a command pattern", "cross-feature communication", or architecture discussions involving testability, decoupling, and service layers. Only activates when ProjectConfig.yaml -> architecture_pattern is "di-first". For simpler projects, use uw-scriptable-object-arch instead.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

GameDay シナリオを AWS FIS 実験テンプレート (CDK) として実装する。「シナリオを FIS にして」「実験テンプレートを作って」「障害注入を実装して」「fault-injection を書いて/直して」など、FIS 実験の実装・修正・レビューの全てで必ず使う。FIS アクションの選定、停止条件 (CloudWatch アラーム)、実験ロールの最小権限 IAM、爆発半径の制御 (selectionMode)、実験レポート設定、ECS タスクアクションの SSM サイドカー前提条件など、検証済みの判断基準とコード例を提供する。lib/constructs/fault-injection.ts を編集するときは内容にかかわらず該当する。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and p...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.