693건 · 관련도순
Assess web applications for XSS, where injected scripts run in a browser, and HTML injection flaws. Classify stored, reflected, and DOM-based issues, demonstrate their impact in controlled tests, and prepare findings with remediation recommendations.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Guides authorized security assessments with Metasploit, from scanning and vulnerability testing to payload generation, code used during a test, and post-exploitation investigation. It also covers session management and recording evidence of findings.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test whether changing record IDs or filenames exposes another user's data in a web application. This skill guides access control checks, evidence collection, impact assessment, and fixes for IDOR, a flaw in resource authorization.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test web applications for HTML injection, where user input becomes page markup. Identify affected inputs, verify stored or reflected behavior, assess visual manipulation and phishing risks, and document findings with remediation guidance.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Assess web applications for path traversal, a flaw that exposes files outside intended folders. Follow structured checks to identify vulnerable inputs, document demonstrated access, assess data exposure, and prepare remediation guidance.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test REST, SOAP, and GraphQL APIs for authentication flaws, improper access to other users’ records, and unsafe input handling. Guides endpoint discovery and request variations to identify vulnerabilities and document evidence of unauthorized access.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Look up commands for authorized penetration tests, from finding hosts and services to checking web vulnerabilities, testing passwords, and analyzing traffic. Examples cover Nmap, Metasploit, Nikto, SQLMap, Hydra, John the Ripper, and other tools.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Runs a security scan on a deployed Power Pages site, fetches the latest scan report, and produces a plain-language summary. Scans the live site's public surface for vulnerabilities and surfaces issues by severity. Use when the user wants to scan, check, test, audit, or assess a published site, find vulnerabilities on production, view the latest scan report, see previous scan results, run a security audit, or asks "how safe is my live site?", "is my site vulnerable?", "audit my production site" — even if they say "find issues" or "check for problems" without mentioning "scan" or "security".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Migrate, modernize, and upgrade codebases to AWS. Run analysis on repos for tech debt, security vulnerabilities, and modernization opportunities. Transforms .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server to Aurora, and upgrades Java/Python/Node.js versions and AWS SDKs. Use when the user says "migrate .NET to AWS", "upgrade Java to 17/21", "modernize COBOL", "modernize mainframe", "move VMware to EC2", "convert SQL Server to Aurora", "upgrade Python version", "migrate AWS SDK", "transform this codebase", "analyze for issues", "find tech debt", "what tech debt", "security vulnerabilities", "CVEs", "what's wrong with my code", "assess my repos", "where do I start", "find what's outdated", "analyze my repos", "AWS Transform - continuous modernization", "continuous modernization" or "continuous-modernization". Don't use for infrastructure provisioning, CI/CD pipelines, or general coding tasks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' 'is this package safe,' or needs to check whether their stack has known security issues.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit applications for AI prompt injection, agent security, and LLM permission boundary vulnerabilities. Use when the user mentions 'prompt injection,' 'LLM security,' 'AI security,' 'jailbreak,' 'indirect prompt injection,' 'prompt leaking,' 'AI red team,' 'LLM vulnerabilities,' 'AI input validation,' 'system prompt extraction,' 'agent security,' 'MCP security,' 'AI permissions,' 'AI privilege escalation,' or needs to secure any application with AI features, AI agents, or LLM integrations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code for bugs, security vulnerabilities, API misuse, consistency issues, simplicity problems, or test coverage gaps and low-value tests by running internal reviews and a peer review in parallel and returning combined findings. Single-concern with a type argument, or full review with no argument. Use when the user asks to "review my code", "full code review", "review my changes", "check for bugs", "scan for bugs", "review correctness", "security audit", "find vulnerabilities", "review security", "check API usage", "verify against docs", "check for cross-file duplication", "review consistency", "check for code reuse", "review simplicity", "find untested code", "find redundant tests", or "review test coverage".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials, and unsafe cryptography. Use when: (1) Performing security code review, (2) Analyzing code for OWASP Top 10 vulnerabilities, (3) Identifying CWE-classified weaknesses, (4) Generating security audit reports, (5) Reviewing code before deployment, or (6) Assessing third-party code security. Findings categorized by CWE ID and severity (Critical/High/Medium/Low).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Instruments code to track the flow of untrusted or sensitive data at runtime, enabling detection of injection vulnerabilities, data leaks, and privilege violations. Use when users need to: (1) Track untrusted input propagation through code, (2) Detect SQL injection, XSS, or command injection vulnerabilities, (3) Identify sensitive data leaks, (4) Monitor privilege escalation paths, (5) Perform dynamic taint analysis for security testing. Supports Python, Java, JavaScript, and C/C++ with configurable taint sources and sinks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects security vulnerabilities by matching code against known vulnerability patterns, insecure coding idioms, and CVE-style patterns. Explains why patterns are risky and under what conditions they are exploitable. Use when analyzing code for security issues, reviewing for common vulnerabilities, or assessing exploitability of suspicious code patterns.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze detected vulnerabilities to assess realistic exploitability by examining control flow, input sources, sanitization logic, and execution context. Use when users need to: (1) Determine if a vulnerability is actually exploitable in practice, (2) Assess severity and impact of security issues, (3) Prioritize vulnerability remediation, (4) Understand attack vectors and exploitation conditions, (5) Generate exploitability reports with proof-of-concept scenarios. Focuses on injection vulnerabilities (SQL, command, XSS, path traversal, LDAP) with detailed analysis of reachability, controllability, sanitization, and impact.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyze CVE reachability in software repositories by examining how vulnerable dependencies are imported and used. Determines whether vulnerable components, classes, or functions are reachable from project code through call chain analysis, reflection detection, dynamic loading patterns, and configuration-gated behavior. Classifies each CVE as likely reachable, possibly reachable, or likely unreachable with supporting evidence. Use when analyzing security vulnerabilities in dependencies, performing post-disclosure CVE triage, assessing vulnerability impact, or when users ask to analyze CVE reachability, check if vulnerabilities are exploitable, or evaluate dependency security risks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes code to identify security-critical time intervals and timing vulnerabilities in authentication, authorization, and time-sensitive security operations. Use this skill when reviewing code for proper timeout enforcement, token expiration, session management, rate limiting, password reset validity, or any time-sensitive security mechanism. Detects missing expiration checks, excessive timeout values, lack of rate limiting, client-side only validation, hardcoded timeouts, and timing attack vulnerabilities. Triggers when users ask to check security timeouts, verify token expiration handling, audit session timeout implementation, review rate limiting, or analyze time-based security controls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'pentest the code', 'OWASP check', or any variation of wanting a security assessment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Check Python environments and requirements files for published vulnerabilities before shipping, upgrading, or approving dependency changes.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.