725 个 · 按相关度排序
Test whether an agent misuses user trust by requesting secrets, making false safety guarantees, recommending unsafe actions, or impersonating authority. Confirmed issues are recorded with dialogue evidence, potential impact, and suggested improvements.
中文简介正在准备中。当前显示英语简介。
Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.
中文简介正在准备中。当前显示英语简介。
Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.
中文简介正在准备中。当前显示英语简介。
Analyze competitor ads from Meta Ad Library and Google Ads Transparency Center, organize their messages and formats, and compare them with your strategy to find unused angles and ideas for campaign tests.
中文简介正在准备中。当前显示英语简介。
Assess internet-exposed VMware management services by identifying versions, matching known vulnerabilities, and checking authentication settings and information exposure. Use the findings to document affected services, supporting evidence, and the potential impact on virtual infrastructure.
中文简介正在准备中。当前显示英语简介。
Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.
中文简介正在准备中。当前显示英语简介。
Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.
中文简介正在准备中。当前显示英语简介。
Inventory old and undocumented API versions, then compare their authentication, request limits, input validation, and exposed fields with current versions. Uses API specifications and archived records to identify overlooked endpoints with weaker security controls.
中文简介正在准备中。当前显示英语简介。
Review build and deployment pipelines for unsafe workflows, exposed credentials, and configuration flaws across GitHub Actions, Jenkins, GitLab CI, and Terraform state files. Use concrete evidence and false-positive checks to distinguish exploitable issues from suspicious settings.
中文简介正在准备中。当前显示英语简介。
Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.
中文简介正在准备中。当前显示英语简介。
Assess externally exposed enterprise SSL VPN gateways by identifying products, checking known vulnerabilities, and reviewing authentication backends and SAML settings. The skill provides vendor-specific checks and a staged workflow that starts with less disruptive identification before deeper testing.
中文简介正在准备中。当前显示英语简介。
Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.
中文简介正在准备中。当前显示英语简介。
Turn existing Markdown material into an article by choosing among suggested next passages. Establish what readers already know, introduce concepts before relying on them, and build the article one selected passage at a time.
中文简介正在准备中。当前显示英语简介。
Shape Markdown notes, fragments, or transcripts into a separate article through a collaborative drafting session. Choose an opening, establish what readers already know, and develop each paragraph or block in an order that introduces concepts before relying on them.
中文简介正在准备中。当前显示英语简介。
Review resolved dependency versions and relevant code for security vulnerabilities. Get findings with evidence, impact, and targeted remedies, distinguishing published dependency warnings from exploit paths demonstrated in the project.
中文简介正在准备中。当前显示英语简介。
Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.
中文简介正在准备中。当前显示英语简介。
Assess SSH services by discovering servers, reviewing encryption settings, testing passwords and keys, and investigating known vulnerabilities. Includes guidance on SSH tunnels and port forwarding, with reports covering configuration, authentication weaknesses, and forwarding setups.
中文简介正在准备中。当前显示英语简介。
Assess WordPress security using WPScan and related tools. Identify versions, themes, plugins, and exposed user information, then examine known vulnerabilities, configuration problems, and weak passwords to produce assessment findings and evidence.
中文简介正在准备中。当前显示英语简介。
Assess web applications for path traversal, a flaw that exposes files outside intended folders. Follow structured checks to identify vulnerable inputs, document demonstrated access, assess data exposure, and prepare remediation guidance.
中文简介正在准备中。当前显示英语简介。
Look up commands for authorized penetration tests, from finding hosts and services to checking web vulnerabilities, testing passwords, and analyzing traffic. Examples cover Nmap, Metasploit, Nikto, SQLMap, Hydra, John the Ripper, and other tools.
中文简介正在准备中。当前显示英语简介。
Guide Windows domain penetration testing through Active Directory reconnaissance, credential attacks, privilege escalation, and certificate service checks. Use references for tools such as BloodHound and Impacket to examine attack paths and understand testing prerequisites.
中文简介正在准备中。当前显示英语简介。
Assess Azure, AWS, and GCP security through resource inventories, authentication checks, permission reviews, and misconfiguration testing. Supports authorized assessments that document exposed credentials, rate risks, and recommend improvements for each cloud platform.
中文简介正在准备中。当前显示英语简介。
Match identified products and versions against CVEs, records of known security vulnerabilities. Assess relevance, evidence quality, and patch status, then produce a candidate list to guide further investigation without attempting exploitation.
中文简介正在准备中。当前显示英语简介。
Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).
中文简介正在准备中。当前显示原文说明。