'cve' 검색 결과

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Write a vulnerability report. Use when the user says "vulnerability report", "vuln report", "security finding", "write up this finding", "pentest finding", "bug bounty report", "security disclosure", "CVE writeup", "document this vulnerability", "how to report a security issue", or needs to formally document a security vulnerability with evidence, impact, and remediation guidance - even if they don't explicitly say "report".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Inventory and prioritize all technical debt in a codebase. Scans for TODO/FIXME/HACK markers and stale comments, outdated and deprecated dependencies with CVE detection, high-churn files and cyclomatic complexity hotspots, duplicated code blocks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze project dependencies for health, security, and bloat — audit outdated, deprecated, vulnerable, duplicate, heavy, and unused packages across npm, pip, cargo, go mod, and more. Produce a dependency health score, CVE inventory, license compatibility matrix, bundle size impact assessment, and a prioritized update plan with migration paths.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Checks outdated packages, unused deps, reinvented wheels, vulnerability scan (CVE/CVSS). Supports mode: full | vulnerabilities_only.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Discovers custom modules (>100 LOC), analyzes purpose, searches OSS alternatives via MCP Research, evaluates quality (stars, license, CVE), generates migration plan.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to "find CVE discussions", "security threat monitoring", "OSINT social media", "vulnerability intelligence", "breach mentions", or "threat intel from Twitter/Reddit".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security launch audit for a public web app BEFORE you ship or hand it to a client — "vibe coders are getting sued", systematized. An executable pipeline: classify (static / full-stack / AI) → run sections (secrets+supply-chain, DB, auth, infra+headers, legal, LLM/injection) orchestrating deterministic tools + manual checks → GO/NO-GO report. Adapted from Prajwal Tomar's playbook, extended with prompt-injection / supply-chain / secret-history / dependency-CVE layers. NOT the same as pre-push (that = clean push; this = is the product itself safe to launch). Triggers — "security checklist for the site", "audit before launch", "is the site safe", "check before handing to client".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Data structure for annotated matrices in single-cell analysis. Use when working with .h5ad files or integrating with the scverse ecosystem. This is the data format skill—for analysis workflows use scanpy; for probabilistic models use scvi-tools; for population-scale queries use cellxgene-census.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit project dependencies for known vulnerabilities (CVEs)

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Before adding/installing any dependency the agent named — verify the package exists (slopsquatting: ~1 in 5 AI suggestions are hallucinated), isn't typo-adjacent, is pinned + locked, and CVE-scanned

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Correlate scanner results with CVE and exploit intelligence and prioritize by CVSS and exploitability.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prioritize vulnerability remediation using KEV-style exploitation context plus asset criticality. Use for CVE triage, patch order decisions, and remediation reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Update npm/yarn/pnpm dependencies using manifest-first, lockfile-aware workflows. Prefer declared version bumps over resolution overrides. Use when updating, upgrading, or patching dependencies; fixing transitive dependency versions; addressing npm audit or CVE findings; or removing stale overrides.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Android device offensive security, forensic extraction, and mobile app exploitation. Use this whenever the user needs to: break into or bypass the lock screen of an Android phone, extract data from a seized Android device for evidence, analyze or reverse-engineer an APK to find vulnerabilities, intercept communications on an Android device, exploit Android apps via deeplinks, steal crypto wallets or app data, set up rogue WiFi to target a phone, or plan any mobile device investigation or penetration test. Also trigger when the user mentions Android forensics, mobile pentesting, law enforcement phone extraction, device exploitation, WhatsApp or Telegram extraction from a phone, Android app reversing, CVE research for Android, or needing a chain of custody for mobile evidence. Even if the user describes the scenario casually or in another language, if they need to gain access to or pull data from an Android phone, use this skill.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Post-fix verification — re-scan the repo, gate on `--exploits weaponized --severity high`, recheck the specific CVE against the new installed version, write the verdict to `.vulnetix/memory.yaml`. Use when confirming a fix landed, validating a version bump did not introduce regressions, or producing a clean-scan attestation for compliance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Answer whether a specific advisory reaches anything in THIS repository — which manifest declares the package, at what version, whether the version is in range, and whether the vulnerable code is reachable. Use when someone asks "does CVE-… affect us", when triaging an advisory against a real codebase, or before spending effort on a fix.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Concrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory. Use when applying a fix for a triaged CVE, evaluating fix-type trade-offs across registry / source / distro patches, producing rollback-safe manifest edits with dry-run verification, or generating a CycloneDX SBOM after the fix lands.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Load when a task asks to research, verify, compare, or look up framework/package behavior, release notes, standards, RFCs, CVEs, or unfamiliar APIs; use repository evidence first, then official docs, and not for codebase navigation alone.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for pip CVE scanning and auto-patching via OSV.dev API.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.