350건 · 관련도순
EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional conditions. Not for penetration testing a running system, not for infrastructure-only scanning, and not for fixing what it finds.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web 漏洞检测时使用。适用于 OWASP Top 10 检测 / XSS / SQLi / SSRF / CSRF。融合 OWASP Testing Guide + Burp Suite + ZAP。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security architecture and threat modeling. OWASP Top 10 2025 analysis, OWASP Agentic AI Top 10 (ASI01-ASI10), AI/LLM security patterns, supply chain security, modern API authentication (OAuth 2.1, DPoP, Passkeys/WebAuthn), vulnerability assessment, and security review for code and infrastructure.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
AI compliance and policy engine — evaluate scan results against OWASP, NIST, SOC 2, ISO 27001, CMMC, EU AI Act, AISVS v1.0, and related frameworks. Generate SBOMs and compliance reports. Use when: "compliance report", "NIST", "SOC 2", "ISO 27001", "OWASP", "EU AI Act", "AISVS", "generate SBOM", "policy check".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
OWASP ASVS v5.0 security verification skill with Drupal 11 mappings. Use when performing security code reviews, implementing security requirements, or verifying security compliance in Drupal projects.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Workflow Phase 8 (optional) — OWASP-aligned security review of pending code changes. Produces a prioritized findings report (Critical/High/Medium/Low) mapped to OWASP Top 10 and CWE IDs. Output at `docs/security/<slug>-<date>.md`. Read-only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Run an infrastructure-first security audit of a repository - secrets archaeology, dependency supply chain, CI/CD pipeline, LLM/AI attack surface, agent skill supply chain, OWASP Top 10, STRIDE threat model, and data classification - with a confidence gate and a pre-emit verification gate that suppress speculative findings. Use when asked for a security audit, threat model, pentest-style review, OWASP pass, or a pre-release security check. Not for reviewing a single diff - use requesting-code-review for that.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Assess web applications against OWASP WSTG and OWASP Top 10 with reproducible evidence capture.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
bu skill covers Dağıt:ing and tuning Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare to protect cloud-hosted applications against OWASP Top 10 attacks. It details configuring managed rule sets, creating custom rules for business logic protection, implementing rate limiting, Dağıt:ing bot management, and reducing false positives through rule tuning and logging analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Securing API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, creating custom rate limiting rules, implementing bot control, setting up IP reputation filtering, and monitoring WAF metrics for security effectiveness.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token vali...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API Tespit, API inventory audit, or attack surf...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.