531건 · 관련도순
Security engineering that protects applications, data, and users from real-world threatsUse when "security, authentication, authorization, encryption, OWASP, vulnerability, XSS, SQL injection, CSRF, secrets, password, JWT, OAuth, permissions, audit, compliance, security, authentication, authorization, encryption, vulnerabilities, OWASP, compliance, audit" mentioned.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Authentication and authorization expert for OAuth, sessions, JWT, MFA, and identity securityUse when "authentication flow, login system, oauth integration, jwt tokens, session management, password hashing, mfa setup, refresh tokens, social login, role-based access, authentication, authorization, oauth, oidc, jwt, sessions, mfa, passkeys, nextauth, supabase-auth, clerk" mentioned.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement authentication and authorization with OWASP Top 10 standards, OAuth 2.0 + OIDC, WebAuthn/Passkeys, session management, and RBAC/ABAC. Use when user asks to implement login, signup, authentication, authorization, JWT, OAuth, SSO, passkeys, MFA, or role-based access. Do NOT use for API key management (use api-forge), encryption at rest, or network-level security (firewalls, WAF).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Maintain authorization-policy OAuth login without an authentication portal, including provider selection, directive parsing, gatekeeper callbacks, opaque sessions, ACL checks, logout, lifecycle, TLS E2E tests, and embedding contracts. Upstream protocol and JWT verification remain with oauth-identity-provider.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Maintain required external authorization decisions, gatekeeper and validator hooks, the HTTP JSON plugin, reusable parsers, and protected-request E2E coverage. Excludes credential authentication and claims enrichment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Maintain authorization ACL rules, typed custom claim fields, their reusable parser, policy integration, and signed-token or authenticated-user E2E coverage.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ASP.NET Core web framework conventions: Minimal API vs MVC controllers, Program.cs composition, DI lifetimes (Scoped/Singleton/Transient), Options pattern with IOptions<T>, middleware ordering (HTTPS redirect → routing → authentication → authorization), model binding and validation (FluentValidation / DataAnnotations), ProblemDetails error handling, structured logging with ILogger<T>, configuration layering (appsettings.json + environment variables + User Secrets), and health checks. Works alongside csharp-foundation:csharp-conventions and aspnet-core-plugin:efcore-patterns. Use this skill to: - Compose Program.cs correctly — register services, configure middleware in the right order, map endpoints. - Apply the Options pattern to avoid passing raw IConfiguration into services. - Write Minimal API endpoint groups with typed results and authorization. - Handle cross-cutting errors uniformly with ProblemDetails. - Configure structured logging and health checks for production readiness. Do NOT use this skill for: - EF Core entity configuration and migrations — see aspnet-core-plugin:efcore-patterns. - C# language idioms — see csharp-foundation:csharp-conventions. - Testing — see csharp-foundation:dotnet-testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Drafts jurisdiction-specific Advance Health Care Directive packages with agent appointment, living will instructions, HIPAA authorization bridge, organ donation preferences, and execution compliance checklists. Trigger when the user mentions advance directive, healthcare proxy, living will, health care agent, HIPAA authorization, medical power of attorney, end-of-life planning, capacity trigger planning, state-specific directive forms, witness/notary requirements for healthcare documents, or cross-state directive portability.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Checks Next.js Server Actions ('use server') for missing authentication/authorization before mutations, missing input validation, and untrusted client-supplied IDs — treating each action as a public HTTP endpoint.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Integrate Apple Pay payments and Wallet passes using PassKit. Use when adding Apple Pay buttons, creating payment requests, handling payment authorization, adding passes to Wallet, configuring merchant capabilities, managing shipping and contact fields, or working with PKPaymentRequest, PKPaymentAuthorizationController, PKPaymentButton, PKPass, PKAddPassesViewController, PKPassLibrary, or Apple Pay checkout flows.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or aut...
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
tespit etmeand prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use proactively for authorization with ActionPolicy. Creates policies, scopes, and integrates with GraphQL/ActionCable. Preferred over Pundit for composable, cacheable authorization.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JWT/session strategies, SecurityService checks, CORS, CSRF awareness for browser apps, rejection handlers, and sensitive-data-safe logging. This should trigger for requests such as Add Micronaut security support; Review Micronaut security configuration; Improve API authorization in Micronaut; Add JWT security in Micronaut; Harden Micronaut route authorization rules. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement REST APIs in ABP Framework with AppServices, DTOs, pagination, filtering, and authorization. Use when building API endpoints for ABP applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.