'sec' 검색 결과

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Check a codebase for known dependency vulnerabilities, hard-coded secrets, and risky code patterns using Ruflo security tools. Choose a scan depth, inspect matching lines, and report verified concerns with a clear account of what was checked.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking pull requests for security regressions
• Inspecting authentication and input-handling code for risky patterns
• Running security checks before production deployment

Audit a codebase with three vulnerability hunters and two engineers who build small demonstrations of suspected flaws. Verify attack paths, assess severity from demonstrated impact, and report evidence, targeted fixes, and checks to prevent recurrence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review security before a release
• Audit security risks in a pull request
• Verify whether a suspected flaw is exploitable

Retrieve U.S. company filings and financial series from SEC EDGAR. Resolve stock tickers to company identifiers, list recent reports with document links, and fetch reported metrics such as revenue or assets without an API key.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find a company's recent annual reports and document links
• List quarterly reports and material event filings
• Retrieve reported revenue or net income series

Assess REST, GraphQL, and gRPC APIs for authentication, access control, input validation, and business logic weaknesses. Use OWASP API Security Top 10, a framework of common API risks, to organize testing and document findings with reproduction steps and remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing API access across user roles
• Checking token handling and request rate limits
• Assessing GraphQL access control and data exposure

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Build and test threat detection rules in Google SecOps using YARA-L 2.0, its rule language. The skill also checks existing coverage with simulated attack events, proposes rules for confirmed gaps, and deploys approved rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating detection rules from known attack behavior
• Tuning existing rules to reduce false positives
• Checking detection gaps against threat reports and CVE disclosures

Review Google Cloud workloads against the security principles of the Well-Architected Framework. Identify gaps in access control, network protection, data handling, and security operations, then receive prioritized recommendations linked to relevant Google Cloud products.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing security during Google Cloud architecture design
• Checking access permissions and network defenses
• Identifying gaps in data protection and security monitoring

Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code for security vulnerabilities
• Checking dependencies and exposed credentials
• Auditing cloud and infrastructure security

Audit an entire repository or a selected folder, package, or path in one review pass. Produce a security report with source evidence, severity assessments, and clear coverage limits, including unresolved questions that need further investigation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run a standard security audit of a repository
• Review a selected folder or package
• Check findings alongside evidence and coverage gaps

Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find structural causes shared by several vulnerabilities
• Compare security architecture options and costs
• Explain proposed changes with before-and-after diagrams

Turn validated Codex Security findings into tracked work in Linear, Jira, GitHub issues, or draft GitHub security advisories. Check for duplicates, preview exact content and audience, and record approved creations, updates, or reuse.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create issues from validated security findings
• Find and reuse existing issues for the same finding
• Register a reviewed batch of security issues

Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review secret exposure in build environments
• Search build logs and caches for leaked credentials
• Assess trust settings between pipelines and cloud services

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A), and any question about NZ government information security requirements or the NZISM framework.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A), and any question about NZ government information security requirements or the NZISM framework.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Provides AWS CloudFormation patterns for security infrastructure including KMS encryption, Secrets Manager, IAM security, VPC security, ACM certificates, parameter security, outputs, and secure cross-stack references. Use when implementing security best practices, encrypting data, managing secrets, applying least privilege IAM policies, securing VPC configurations, managing TLS/SSL certificates, and implementing defense in depth strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, aut...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of cursor-rules-java project

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.