695건 · 관련도순
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Proactively search for security threats, vulnerabilities, and suspicious patterns in applications and infrastructure before they cause damage. Use when conducting security audits, identifying vulnerabilities, analyzing security logs, detecting suspicious patterns, investigating potential breaches, performing penetration testing, or implementing security monitoring.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection testing, SQLi in APIs, NoSQL injection, SSRF testing, or API input validation assessment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Java Spring Boot 서비스의 인증, 접근 권한, 입력 검증 등 보안 대책을 검토합니다. 비밀 정보 관리부터 API 호출 제한과 의존성까지 확인합니다.
AgentShield로 Claude Code 설정의 비밀 정보 직접 기재, 과도한 권한, 악성 지시 주입 위험을 검사하고 보고합니다. 일부 문제는 자동으로 수정합니다.
코드와 설정의 보안 문제를 조사하고 공격 경로와 영향의 근거, 조사 범위와 미확인 사항을 기록합니다. 지원 환경에서는 격리된 재현 검증과 수정 후보 작성도 수행합니다.
Check a codebase for known dependency vulnerabilities, hard-coded secrets, and risky code patterns using Ruflo security tools. Choose a scan depth, inspect matching lines, and report verified concerns with a clear account of what was checked.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Benchmark security detection systems against 10 known vulnerabilities and nine harmless decoys. Compare four approaches, including an evolved champion, and receive structured JSON covering detection, false alarms, patch tests, reproduction, unsafe outputs, and overall pass or fail.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Assess an application against OWASP Top 10:2025 risk categories using Strix. Get findings backed by working exploit examples, organized by category, with clear explanations of what was tested and what remains unassessed.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Run security tests for web apps, APIs, and source code on Strix Cloud without local Docker or an LLM key. Register targets, review findings in a team dashboard, export results, and configure recurring scans or PR reviews.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.