'sast' 검색 결과

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

OSS-only security for OWASP Top 10, pentest, vuln testing (XSS, SSRF, CSRF, business-logic, Host header), threat modeling (STRIDE, ATT&CK), Sigma rules, SAST, code audit, AI/LLM red-team, or replacing paid tools (Burp, Nessus, Splunk) with OSS.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Neighborhood Analysis — schools, crime, walkability, demographics, amenities, growth trajectory, and natural disaster risk with Neighborhood Score (0-100)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

I am a veteran print production specialist with 15+ years in tabletop game manufacturing. I've shepherded hundreds of games from digital files to retail-ready products, working with manufacturers from The Game Crafter to Panda GM to Cartamundi. My expertise spans the entire production pipeline: color management, dieline creation, paper selection, finishing techniques, component nesting, insert design, and the critical art of the unboxing experience. I've learned the hard way about RGB-to-CMYK disasters, registration drift, humidity warp, and minimum font sizes that become illegible smudges. I know the difference between 280gsm blue-core and 320gsm black-core card stock by feel. I can tell you why your rich black needs to be C60-M40-Y40-K100, not just K100. I understand why your box needs 15mm clearance on each dimension, and why that gorgeous neon green in your design will become a muddy olive in print. Use when "print my game, packaging design, prepare files for print, dieline, print specifications, board game manufacturing, card game printing, box design, bleed and safe area, CMYK conversion, paper stock, card finish, foil stamping, embossing, unboxing experience, thermoform insert, punchboard design, component manufacturing, Panda GM, Game Crafter, Cartamundi, print-production, packaging, manufacturing, board-games, card-games, cmyk, dieline, die-cutting, offset-printing, tabletop" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Git is deceptively simple to learn and incredibly hard to master. The difference between a team that ships and a team that fights merge conflicts all day comes down to workflow discipline. Your git history is documentation - make it tell a story future you can understand. This skill covers branching strategies (trunk-based, gitflow, GitHub flow), commit hygiene, merge vs rebase, conflict resolution, and the commands you actually need. Key insight: most git disasters come from not understanding what you're about to do. 2025 lesson: Trunk-based development with short-lived branches has won. Long-lived feature branches are a code smell. If a branch lives more than a few days, something is wrong with your architecture or process. Use when "git workflow, branching strategy, git merge, git rebase, merge conflict, git commit, trunk-based, gitflow, git history, git revert, git reset, git, version-control, workflow, branching, commits, merge, rebase, collaboration" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

When things go wrong - and they will - how you communicate determines whether you lose customers for a day or lose trust forever. Crisis communications isn't about spin or damage control. It's about being human when your company is at its most vulnerable. This skill covers incident response communications, public apologies, data breach notifications, service outages, PR crises, and the aftermath. The goal isn't to look good - it's to be good, and communicate that clearly. Use when "crisis, incident, outage, down, breach, apology, we messed up, customers are angry, PR disaster, viral complaint, status page, postmortem, trust recovery, bad press, crisis, incident, communications, apology, trust, status-page, outage, breach, postmortem, recovery" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Resilience testing specialist for failure injection, game day planning, and building confidence in system reliabilityUse when "chaos engineering, resilience testing, failure injection, game day, fault tolerance, chaos experiment, disaster recovery, reliability testing, chaos-engineering, resilience, failure-injection, game-day, fault-tolerance, reliability, testing, litmus, chaos-monkey, ml-memory" mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

DevOps 与站点可靠性工程 (SRE) — 平台 / 基础设施 / 可靠性工程师的认知操作系统, 覆盖软件交付 + 运维全生命周期 (CI/CD 与发布工程 trunk-based + 渐进式发布 canary/blue-green/feature flag + GitOps Argo CD/Flux / 基础设施即代码 Terraform/OpenTofu/Pulumi/Ansible + policy-as-code OPA / 容器与编排 Docker/Kubernetes + Helm/Kustomize + service mesh Istio/Linkerd / 可观测性 Prometheus + Loki + OpenTelemetry + Honeycomb + eBPF + RED/USE / SLO-SLI-error budget 与可靠性工程 Google SRE 学科 + 容量规划 + 优雅降级 / 事件管理与 on-call 事件指挥 + PagerDuty + runbook + 无指责复盘 + MTTR / 云平台与 FinOps AWS/GCP/Azure + 成本优化 + 弹性伸缩 / 平台工程与开发者体验 IDP + Backstage + golden path + Team Topologies / DevSecOps 与供应链安全 shift-left + SBOM + SLSA + sigstore + Vault / 韧性与混沌工程 fault injection + game day + 安全科学 / DORA 指标与工程效能 部署频率 + 变更前置时间 + 变更失败率 + Accelerate 研究 / 数据库与有状态运维 schema 迁移 + 备份容灾) — 不含 通用应用开发 / 纯云销售认证速成 / 'DevOps = 跑 Jenkins 的岗位' 窄化误解 / ITIL 工单文化传统运维 (旧范式仅做边界) / 把手工运维 ClickOps 当稳态 (是 toil, 本 skill 核心反模式) (DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, Helm / Kustomize, service mesh Istio / Linkerd), (d) observability (the three pillars + beyond — metrics Prometheus / VictoriaMetrics, logs Loki / ELK, traces OpenTelemetry / Jaeger / Tempo, high-cardinality observability Honeycomb, eBPF, RED / USE methods, SLO-based alerting), (e) SLO / SLI / error budgets & reliability engineering (Google SRE discipline — service level objectives, error budget policy, toil budgets, capacity planning, load shedding, graceful degradation), (f) incident management & on-call (incident command, PagerDuty / Opsgenie, runbooks, blameless postmortems, MTTR / MTTD, error budget burn), (g) cloud platforms & FinOps (AWS / GCP / Azure well-architected, multi-region, cost optimization, autoscaling), (h) platform engineering & developer experience (internal developer platforms, Backstage, golden paths, self-service, Team Topologies), (i) DevSecOps & supply-chain security (shift-left, SAST / DAST, SBOM, SLSA, sigstore / cosign, secrets management Vault), (j) resilience & chaos engineering (chaos experiments, fault injection, game days, resilience engineering / safety science), (k) DORA metrics & engineering effectiveness (deployment frequency, lead time, change failure rate, MTTR, the Accelerate research), (l) databases & stateful operations (schema migrations, backups / DR, replication); NOT generic software development / app feature coding (是 平行学科, DevOps/SRE 关注 delivery + operability 不是 product feature), NOT pure cloud sales / certification cram without operational depth, NOT 'DevOps = a job title that runs Jenkins' 的窄化误解 (DevOps 是 文化 + 实践, SRE 是 Google 对 reliability 的工程化具体实现), NOT ITIL-heavy 传统运维 工单文化 (是 被 DevOps 取代的旧范式, 仅做边界标注), NOT manual ops / ClickOps as a steady state (是 toil, 本 skill 的核心反模式).) Master OS — automated mastery of DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, He

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

A strict code reviewer, pair programmer, debugger, and mentor for Python, Bash, Google Apps Script, JavaScript, and Swift/Apple platforms. Use when writing, reviewing, debugging, planning, or securing code, or for senior-level rigor, a security review, or mentoring. Mode triggers — REVIEW: (critique + refactor), EXPLAIN: (teach), MVP:/PROTOTYPE: (lean-but-safe), DEBUG: (root-cause), AUDIT: (report-first); default is pair-programming. Drives a spec→plan→TDD→verify loop with a deterministic-first, verify-before-asserting (anti-hallucination) discipline. Enforces a security floor (secrets, injection, input validation, isolation, least privilege, authn) and a backup/continuity floor on a phase-aware rigor ladder (Prototype→MVP→Production) — cheap ≠ insecure. Covers testing & fuzzing, SAST/secret-scan/type-check/supply-chain gates, multi-tenant data protection, resilience & DR, scalability, CI/CD, cloud/containers/DBs, and accessible UI — deep references read on demand.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds security testing pipelines for SAST, DAST, SCA, secrets, containers. Use when wiring scanners into CI or regression gates.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Responding to incidents: identifies impact scope, formulates recovery procedures, creates postmortems. Use when incident response or disaster recovery is needed. Delegates fixes to Builder.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Auditing skill/plugin/MCP supply chains and live package compromise: manifests, hidden injection, IoC scans, persistence-first eradication, and gated credential rotation. Not for app SAST (Sentinel).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Static analysis tool runner. Wraps ESLint, Semgrep, Bandit, Clippy, and language-specific analyzers with unified severity output. Use when deeper code analysis needed beyond pattern matching.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

代码安全审查时使用。适用于 PR 审查 / SAST 扫描 / 手动代码审计。融合 OWASP Code Review Guide + Semgrep + SonarQube。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design and execute chaos engineering experiments using Litmus or Chaos Mesh. Test system resilience through controlled fault injection, validate hypothesis-driven tests, and improve failure recovery. Use before major product launches, after architecture changes to validate resilience, during GameDays or disaster recovery drills, to validate assumptions about failure modes, or as part of an SRE maturity program.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release gates, supply-chain controls, SBOMs, policy-as-code, and secure SDLC workflows. Use for pipeline hardening, deployment risk reviews, security automation, and remediation planning.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design backup strategies that survive real disasters: 3-2-1 rule, versioning, testing restores, and covering all devices. Use when setting up backups or auditing whether current backups actually work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs `rafter run` (remote SAST+SCA), `rafter secrets` (local secrets-only), `rafter agent audit`, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of that, a quick surface check is enough. When such surface IS present and no rafter skill or CLI call has been made, invoke this before handing the task off — an un-evaluated "done" on genuine security surface is not done.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review owned or authorized code for security using structure-first evidence: AST/structure maps, call graphs, complexity, Source/Sink flow, and defensive findings. Use when asked for security review, vulnerability review, AST structure map review, SAST triage, Source/Sink, taint flow, parser/scanner hardening, CI/CD security, LLM/agent tool boundary review, 脆弱性レビュー, 構造マップ, セキュリティレビュー.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.