「security」の検索結果

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

日本語の概要は準備中です。原文の説明を表示しています。

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.

日本語の概要は準備中です。原文の説明を表示しています。

Reverse engineer and security-test Telegram bots — API analysis, callback interception, exploit discovery, and vulnerability documentation

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden VPS security — fail2ban, SSH hardening, firewall setup

日本語の概要は準備中です。原文の説明を表示しています。

Scan the codebase for common security issues: hardcoded secrets, SQL injection vectors, XSS, unvalidated inputs, and insecure defaults. Use before deploying, as part of code quality review, or when asked to check for security issues.

日本語の概要は準備中です。原文の説明を表示しています。

Use for security review, audit, hardening, compliance, DevSecOps, network, infrastructure, or application security with focused references.

日本語の概要は準備中です。原文の説明を表示しています。

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

日本語の概要は準備中です。原文の説明を表示しています。

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

日本語の概要は準備中です。原文の説明を表示しています。

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

日本語の概要は準備中です。原文の説明を表示しています。

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

日本語の概要は準備中です。原文の説明を表示しています。

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Activates for requests involving cloud incident response, AWS security incident, Azure compromise, GCP breach, cloud forensics, or cloud identity compromise.

日本語の概要は準備中です。原文の説明を表示しています。

Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.

日本語の概要は準備中です。原文の説明を表示しています。

Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.

日本語の概要は準備中です。原文の説明を表示しています。

Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.

日本語の概要は準備中です。原文の説明を表示しています。

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

日本語の概要は準備中です。原文の説明を表示しています。

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

日本語の概要は準備中です。原文の説明を表示しています。

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

日本語の概要は準備中です。原文の説明を表示しています。

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.

日本語の概要は準備中です。原文の説明を表示しています。

Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-160 Vol 1 (Engineering Trustworthy Secure Systems) and Vol 2 (Developing Cyber-Resilient Systems). Use for systems security engineering (SSE): the three SSE framework contexts (problem/solution/trustworthiness), the 30+ design principles for trustworthy secure design, trustworthiness and assurance/assurance cases, security across the ISO/IEC/IEEE 15288 life-cycle process groups, and the Vol 2 cyber-resiliency engineering framework — 4 goals (anticipate/withstand/recover/adapt), objectives, 14 techniques, implementation approaches, and design principles for the APT/adverse-conditions threat model. Bridges systems engineering and the NIST security cluster (CSF/SSDF/RMF). Does not reproduce ISO/IEC/IEEE 15288 process text, nor cover SP 800-53 control catalogs in depth.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-37 Revision 2, the Risk Management Framework (RMF) for information systems and organizations. Use for the seven RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks; the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization (FIPS 199/200 high-water mark) and control selection/tailoring (SP 800-53/53B baselines); assessment, the authorization decision and risk acceptance, continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management. This is the security-and-privacy-risk-governance edge of systems engineering — it governs how much protection and whether to accept residual risk, complementing the disciplines that decide how protection is built. Does NOT reproduce the SP 800-53 control catalog or its baselines, the FIPS impact tables, or the ISO/IEC/IEEE 15288 process text; it names and routes to them rather than restating them.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST Secure Software Development Framework (SSDF) v1.1 (SP 800-218). Use for secure software development practices, SDLC security integration, software supply chain security, vulnerability disclosure, SBOM, threat modelling, secure coding, build hardening, EO 14028 compliance. Covers the four SSDF practice groups (PO, PS, PW, RV) only; does not cover NIST CSF, SP 800-53 controls, or cloud-specific security frameworks in depth.

日本語の概要は準備中です。原文の説明を表示しています。

Pre-fills a customer's or prospect's security or third-party risk questionnaire from the organisation's own answer sources (prior questionnaires, answer library, policies), returning one row per question with a draft answer marked Reused, Adapted, Missing or Routed, its source, date, scope match and owner, plus the Missing list by owner. Never invents an answer, certification or control and never submits. Use when the user asks to "pre-fill this security questionnaire", "take a first pass at the customer's due diligence form", "answer this vendor assessment from our previous responses", "populate the third-party risk questionnaire" or "which questions can we reuse answers for". Do not use for screening a vendor's own answers, use vendor-risk-screening-brief instead; for RFP or tender answers use rfp-response-drafter. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck or plan in character as a Chief Information Security Officer archetype and returns a DRAFT review with a verdict, findings cited to specific passages, security and compliance risks and the five interrogation questions a real CISO would ask. Use when the user asks to "run a CISO review", "pressure-test the security of this plan", "what would our CISO say about this" or "check the privacy and third-party risk". Do not use for contract, liability or regulatory-interpretation reviews, use general-counsel-reviewer instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。