119건 · 관련도순
Reviews Remix v2 code for v1-shape meta exports (BREAKING in v2), cookie security gaps (httpOnly, secure, secrets rotation), auth gates in wrong layer, and missing CSRF. Use when reviewing meta/SEO, session, auth, or form-mutation code in a Remix v2 codebase.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Laravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥管理、速率限制和安全部署。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR 绕过变体、2887 份 HackerOne 真实 High/Critical 已披露案例、77,000+ WooYun 案例统计、国产 OA / 中间件指纹库、银行 / 电信行业垂直 playbook。当用户提到 "src 挖洞 / src 漏洞挖掘 / bug bounty / 众测 / hackerone / 漏洞赏金 / SRC / 任意 X 漏洞 / 渗透测试" 或问"如何挖某个目标 / 怎么测某个 API / 如何绕过 WAF" 时触发。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web 漏洞检测时使用。适用于 OWASP Top 10 检测 / XSS / SQLi / SSRF / CSRF。融合 OWASP Testing Guide + Burp Suite + ZAP。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use for security and trust boundaries. Triggers: auth, secrets, XSS, CSRF, SQL injection, JWT, OAuth, OWASP, PII, uploads, payments, supply chain, CI integrity, agent security, threat model.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Secrets management, XSS prevention, CSRF protection, dependency scanning, DOMPurify sanitization, CSP headers, CODEOWNERS, HttpOnly cookies
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
用于审查前端安全风险，如 XSS、CSRF、敏感数据暴露、不安全 DOM API、不可信用户输入、认证/token 处理、支付流程、文件上传、CSP、依赖风险或第三方脚本；中文触发词包括 安全审查、安全检查。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing frontend security risks such as XSS, CSRF, sensitive data exposure, unsafe DOM APIs, untrusted user input, authentication/token handling, payment flows, file upload, CSP, dependency risk, or third-party scripts; Chinese triggers include security review, security check.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security-first code review & vulnerability prevention (IDOR, XSS, CSRF, SSRF, SQLi, Auth/JWT, Mass Assignment, Sensitive Data Exposure). Use when writing web features, designing endpoints, or auditing security.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ตรวจช่องโหว่ OWASP Top 10 JWT SQL injection CSRF พร้อมเสนอวิธีแก้แบบ pentester
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.