408 个 ・ 集成工具: GitLab · 按人气排序
Investigate how credentials can be exposed in CI/CD, the systems that build and deploy software. Covers environment variables, logs, credential stores, cloud trust settings, and runner tokens, with methods to assess access scope and defensive controls.
中文简介正在准备中。当前显示英语简介。
Assess security weaknesses in CI/CD systems that automate software builds and delivery. Covering GitHub Actions, Jenkins, GitLab CI, and Azure DevOps, the skill examines unsafe inputs, excessive permissions, exposed credentials, and tampered build outputs, alongside detection and defensive controls.
中文简介正在准备中。当前显示英语简介。
Deploy applications to Render by inspecting the code and preparing service settings. Generate a render.yaml configuration or create services through MCP, an agent tool connection, then check deployment status, logs, and basic service health.
中文简介正在准备中。当前显示英语简介。
Push the current Git branch and get a link to its GitLab CI or GitHub Actions runs. The workflow checks for uncommitted changes and blocks direct pushes to main, master, and production before proceeding.
中文简介正在准备中。当前显示英语简介。
Check CI, the automated checks run on code changes, for the current branch alongside recent commits. Supports GitLab CI and GitHub Actions, with optional pull request or merge request numbers and links when command-line tools are unavailable.
中文简介正在准备中。当前显示英语简介。
Prepare a branch for a pull request by running local tests, checking types for Node projects, pushing commits, and showing the CI pipeline link. Failed checks stop the workflow before the push.
中文简介正在准备中。当前显示英语简介。
Write and review GitHub Actions workflows for syntax and structural correctness. Check quoting around expressions and special characters, then validate with actionlint, a workflow checker, to catch errors that ordinary YAML parsing can miss.
中文简介正在准备中。当前显示英语简介。
Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.
中文简介正在准备中。当前显示英语简介。
Review CI/CD pipelines, the workflows that build and release software, for unsafe code execution, exposed secrets, and excessive permissions. Combine automated scanning with manual checks to document reproducible findings and suggested fixes.
中文简介正在准备中。当前显示英语简介。
Build CI workflows that use mirrord to test applications against services in a real Kubernetes cluster. Configure runner access, start and stop application sessions, validate configuration files, and troubleshoot connection, permission, and logging problems.
中文简介正在准备中。当前显示英语简介。
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.
中文简介正在准备中。当前显示原文说明。
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
中文简介正在准备中。当前显示原文说明。
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.
中文简介正在准备中。当前显示原文说明。
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).
中文简介正在准备中。当前显示原文说明。
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.
中文简介正在准备中。当前显示原文说明。
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card double-spend, MFA-OTP-validate race, account-create race, faucet/crypto token double-mint, email-activation race, vote/upvote inflation, password-reset token race, rate-limit bypass via concurrent requests. Use when hunting race conditions, TOCTOU bugs, MFA-bypass-via-timing.
中文简介正在准备中。当前显示原文说明。
Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
中文简介正在准备中。当前显示原文说明。
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.
中文简介正在准备中。当前显示原文说明。
Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.
中文简介正在准备中。当前显示原文说明。
Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, broken-object-level-authz, auth-bypass via unscoped mutations, and PII exposure from missing field-level authz. Use when hunting graphql on any target.
中文简介正在准备中。当前显示原文说明。
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.
中文简介正在准备中。当前显示原文说明。
为此仓库配置 engineering skills：设置其 issue tracker、triage labels 词汇与 domain docs 布局。在首次使用其他 engineering skills 前运行一次。
中文简介正在准备中。当前显示原文说明。
Production-ready CI/CD configurations for Playwright — GitHub Actions, GitLab CI, CircleCI, Azure DevOps, Jenkins, Docker, parallel sharding, reporting, code coverage, and global setup/teardown.
中文简介正在准备中。当前显示原文说明。
Battle-tested Playwright patterns for E2E, API, component, visual, accessibility, and security testing. Covers locators, fixtures, POM, network mocking, auth flows, debugging, CI/CD (GitHub Actions, GitLab, CircleCI, Azure, Jenkins), framework recipes (React, Next.js, Vue, Angular), and migration guides from Cypress/Selenium. TypeScript and JavaScript.
中文简介正在准备中。当前显示原文说明。