53 个 · 按相关度排序
Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.
中文简介正在准备中。当前显示英语简介。
Compare multiple NemoClaw pull requests addressing the same issue. It checks merge eligibility, correctness, quality, and attribution, then produces an evidence-based recommendation for merging or choosing a candidate for further repair.
中文简介正在准备中。当前显示英语简介。
Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.
中文简介正在准备中。当前显示英语简介。
Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.
中文简介正在准备中。当前显示英语简介。
Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.
中文简介正在准备中。当前显示英语简介。
Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.
中文简介正在准备中。当前显示英语简介。
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
中文简介正在准备中。当前显示英语简介。
Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.
中文简介正在准备中。当前显示原文说明。
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
中文简介正在准备中。当前显示原文说明。
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
中文简介正在准备中。当前显示原文说明。
Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.
中文简介正在准备中。当前显示原文说明。
Static Application Security Testing patterns, OWASP Top 10 checklist, language-specific vulnerability patterns, Semgrep rule writing guide, and CI/CD integration. Use when scanning code for security vulnerabilities or writing custom SAST rules.
中文简介正在准备中。当前显示原文说明。
Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
中文简介正在准备中。当前显示原文说明。
Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.
中文简介正在准备中。当前显示原文说明。
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
中文简介正在准备中。当前显示原文说明。
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
中文简介正在准备中。当前显示原文说明。
Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged
中文简介正在准备中。当前显示原文说明。
Static analysis tool runner. Wraps ESLint, Semgrep, Bandit, Clippy, and language-specific analyzers with unified severity output. Use when deeper code analysis needed beyond pattern matching.
中文简介正在准备中。当前显示原文说明。
代码安全审查时使用。适用于 PR 审查 / SAST 扫描 / 手动代码审计。融合 OWASP Code Review Guide + Semgrep + SonarQube。
中文简介正在准备中。当前显示原文说明。
Run CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.
中文简介正在准备中。当前显示原文说明。
Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.
中文简介正在准备中。当前显示原文说明。
Natural-language orchestration of security tools through Gemini. Translates intent ("scan this scope for exposed admin panels") into safe, parameterized tool pipelines using nmap, masscan, naabu, httpx, nuclei, ffuf, gobuster, subfinder, amass, dnsx, katana, gau, semgrep, trivy, checkov, gitleaks, syft, grype, and custom scripts. Use when the user wants Gemini to drive a chain of CLI tools end to end with guardrails.
中文简介正在准备中。当前显示原文说明。