“vulnerabilities”的搜索结果

Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.

中文简介正在准备中。当前显示英语简介。

• Turning vulnerability notes into a disclosure report
• Checking source code and proof-of-concept claims
• Preparing separate reports for multiple vulnerabilities

Run an AI vulnerability scan on uncommitted changes, changes against main, or an entire codebase. Filter candidate files, investigate potential security issues, and review findings with severity ratings, with options to revalidate and export results.

中文简介正在准备中。当前显示英语简介。

• Checking uncommitted changes for vulnerabilities
• Reviewing security issues in changes against main
• Scanning an existing codebase

Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Cosmos SDK modules
• Reviewing IBC integrations
• Assessing chain security before launch

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

中文简介正在准备中。当前显示英语简介。

• Security checks before an Algorand contract audit
• Reviewing TEAL or PyTeal transaction validation
• Verifying fixes for reported vulnerabilities

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

中文简介正在准备中。当前显示英语简介。

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.

中文简介正在准备中。当前显示英语简介。

• Assessing container isolation
• Reviewing permissions and exposed runtime sockets
• Checking known runtime vulnerabilities

Review source code without running it to identify potential security vulnerabilities. Findings include severity, confidence, attack scenarios, and suggested fixes, delivered as JSON for further triage and Markdown for human review.

中文简介正在准备中。当前显示英语简介。

• Review source code for potential vulnerabilities
• Focus a scan using a threat model
• Prepare findings for further triage

Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.

中文简介正在准备中。当前显示英语简介。

• Reviewing security risks during system design
• Assessing an inherited codebase without its owner
• Refining a code-based draft with the application owner

Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.

中文简介正在准备中。当前显示英语简介。

• Turning vulnerability notes into a disclosure report
• Checking source code and proof-of-concept claims
• Preparing separate reports for multiple vulnerabilities

Examines code or code changes for plausible security vulnerabilities by tracing attacker-controlled input to dangerous operations or failed safeguards. Records candidate issues with affected locations, supporting evidence, potential impact, and controls that need further validation.

中文简介正在准备中。当前显示英语简介。

• Discover candidate vulnerabilities in code changes
• Trace input paths to authorization gaps or injection risks
• Investigate code locations linked to a security advisory

Review web code for security, browser compatibility, and code quality. Covers HTTPS, dependency vulnerabilities, security headers, outdated APIs, HTML structure, error handling, and cleanup of event listeners, with examples and audit checklists to guide improvements.

中文简介正在准备中。当前显示英语简介。

• Review HTTPS, security headers, and cookies
• Check dependencies and handling of user input
• Replace outdated APIs and improve browser compatibility

Check an OpenClaw environment for risky settings, unsafe skills, known software vulnerabilities, and privacy exposure. It combines local checks with optional online threat lookups and also supports reviewing individual skills before installation.

中文简介正在准备中。当前显示英语简介。

• Running an OpenClaw security health check
• Reviewing a skill before installation
• Auditing risks across installed skills

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

中文简介正在准备中。当前显示原文说明。

Analyze dependencies for known security vulnerabilities and outdated versions. Use when auditing third-party libraries. Trigger with 'check dependencies', 'scan for vulnerabilities', or 'audit packages'.

中文简介正在准备中。当前显示原文说明。

Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.

中文简介正在准备中。当前显示原文说明。

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

中文简介正在准备中。当前显示原文说明。

Runs a security scan on a deployed Power Pages site, fetches the latest scan report, and produces a plain-language summary. Scans the live site's public surface for vulnerabilities and surfaces issues by severity. Use when the user wants to scan, check, test, audit, or assess a published site, find vulnerabilities on production, view the latest scan report, see previous scan results, run a security audit, or asks "how safe is my live site?", "is my site vulnerable?", "audit my production site" — even if they say "find issues" or "check for problems" without mentioning "scan" or "security".

中文简介正在准备中。当前显示原文说明。

Migrate, modernize, and upgrade codebases to AWS. Run analysis on repos for tech debt, security vulnerabilities, and modernization opportunities. Transforms .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server to Aurora, and upgrades Java/Python/Node.js versions and AWS SDKs. Use when the user says "migrate .NET to AWS", "upgrade Java to 17/21", "modernize COBOL", "modernize mainframe", "move VMware to EC2", "convert SQL Server to Aurora", "upgrade Python version", "migrate AWS SDK", "transform this codebase", "analyze for issues", "find tech debt", "what tech debt", "security vulnerabilities", "CVEs", "what's wrong with my code", "assess my repos", "where do I start", "find what's outdated", "analyze my repos", "AWS Transform - continuous modernization", "continuous modernization" or "continuous-modernization". Don't use for infrastructure provisioning, CI/CD pipelines, or general coding tasks.

中文简介正在准备中。当前显示原文说明。

Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.

中文简介正在准备中。当前显示原文说明。