151건 · 관련도순
Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to find XXE or XML injection bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-side request forgery bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scripting bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authorization checks on user-supplied identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/idor-results.md. Use when asked to find IDOR or authorization bypass bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md. Use when asked to find business logic, logic flaws, or abuse-of-function bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/pathtraversal-results.md. Use when asked to find path traversal, directory traversal, or file disclosure bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/sqli-results.md. Use when asked to find SQLi or database injection bugs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Sets up automated database backup, restore, and disaster recovery procedures for PostgreSQL, MySQL, MongoDB, and Redis. Use when you need to implement backup schedules, point-in-time recovery, cross-region replication, backup verification, or disaster recovery runbooks. Trigger words: database backup, pg_dump, mysqldump, mongodump, disaster recovery, point-in-time recovery, WAL archiving, backup rotation, restore database, RTO, RPO, backup verification.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
事業継続計画（BCP）と災害復旧計画（DRP）の策定支援スキル。ビジネスインパクト分析、リスク評価、復旧戦略策定、 BCP/DRP文書作成、テスト・訓練計画を提供。ISO 22301準拠。 Use when developing business continuity plans, disaster recovery strategies, or conducting business impact analysis. Triggers: "BCP", "business continuity", "disaster recovery", "DRP", "business impact analysis", "BIA", "contingency planning".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Retrieve climate-related disaster records, including floods, cyclones, droughts, and heatwaves. Check affected countries, severity, status, and population figures, then consult climate anomalies and related news for broader context.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Evaluate Google Cloud workloads and develop reliability recommendations covering user experience goals, redundancy, monitoring, and recovery. The skill applies the Google Cloud Well-Architected Framework to help identify gaps and plan improvements suited to business requirements.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Design cloud architectures and migration plans for AWS, Azure, and GCP. Produce service diagrams, selection rationale, security designs, cost estimates, and recovery strategies, with deployment and rollback plans that account for availability and operational monitoring.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Work through the first hours and days after a disaster — a fire, flood, storm, or evacuation — in the right order: safety and people first, then documenting for insurance and aid, then the immediate recovery steps, without missing the things that cost money or health later. Use when someone says 'my house flooded/burned', 'what do I do after the disaster', 'we just evacuated, now what', or 'the storm damaged everything'. Produces a triaged action plan (safety → document → claim → recover), the do-not-miss list, and where to get help. Not legal advice; routes to emergency services and official aid.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.