“secure”的搜索结果

Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".

中文简介正在准备中。当前显示原文说明。

Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.

中文简介正在准备中。当前显示原文说明。

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks how to "use VibeTags", "add VibeTags annotations", "set up AI guardrails", "protect code from AI", "configure AI platforms", asks about @AILocked, @AIContext, @AIDraft, @AIAudit, @AIIgnore, @AIPrivacy, @AICore, @AIPerformance, @AIContract, @AITestDriven, @AIThreadSafe, @AIImmutable, @AIDeprecated, @AIObservability, @AIRegulation, @AIArchitecture, @AILegacyBridge, @AIStrictClasspath, @AIInternationalized, @AIPublicAPI, @AISchemaSafe, @AIStrictExceptions, @AIStrictTypes, @AIParallelTests, @AIIdempotent, @AIFeatureFlag, @AISecure, @AICallersOnly, @AISandboxOnly, @AIMemoryBudget, @AIPure, @AIDomainModel, @AIExtensible, @AIInputSanitized, @AISecureLogging, @AIExplain, @AIPrototype, @AISunset, @AITemporary annotations, or wants to control how AI tools interact with Java code.

中文简介正在准备中。当前显示原文说明。

bu skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.

中文简介正在准备中。当前显示原文说明。

bu skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses Tespit etme misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before Dağıt:ment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.

中文简介正在准备中。当前显示原文说明。

bu skill instructs security practitioners on Dağıt:ing Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments. It covers enabling Defender plans for servers, containers, storage, and databases, configuring security recommendations, managing Secure Score, and integrating with the unified Defender portal for centralized threat management.

中文简介正在准备中。当前显示原文说明。

Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credenti...

中文简介正在准备中。当前显示原文说明。

Use when setting up a secure email inbox for any AI agent — configuring inbound email via Resend, webhooks, tunneling for local development, and implementing security measures to prevent prompt injection attacks. Also use when someone mentions 'agent email', 'bot inbox', 'receive emails for agent', 'agent webhook', 'email security for AI', 'prompt injection via email', 'inbound email for bot', or wants their AI agent to receive and respond to emails securely.

中文简介正在准备中。当前显示原文说明。

Secure secret management using 1Password CLI. Detect plaintext secrets in files and codebases, convert environment files to 1Password templates, inject secrets securely using op inject, and audit codebases for security compliance.

中文简介正在准备中。当前显示原文说明。

Security checks for repository ingestion — scans repos for poisoned examples, dependency and supply-chain attacks, file/path traversal, format-based attacks, and enforces quarantine-before-commit. Load as part of the secure-* skill sequence whenever an agent reads, ingests, or learns from a GitHub repository. Also load when the user asks to check a repo for poisoned code, scan dependencies, verify supply chain safety, check for path traversal, scan repo files for attacks, or audit a repo before ingestion. Covers Issues 3, 4, 7, 8 from the agent security threat model: poisoned training data, dependency attacks, file/path attacks, and format-based attacks.

中文简介正在准备中。当前显示原文说明。

Content sanitization and hidden-content detection for agent skill security. Scans markdown, HTML, and text for visually hidden but agent-readable attacks: CSS-hidden text (display:none, color:white, font-size:0, opacity:0), HTML comments with instructions, collapsible details sections, zero-width unicode, homoglyphs, misleading links, and inline HTML in markdown. Enforces mandatory sanitization before external content enters agent context. Load as part of the secure-* sequence during any repo scan or skill audit. Also load for sanitize content, check hidden text, scan markdown attacks, strip HTML, detect invisible instructions, check zero-width chars. Core principle: visibility does not equal influence — hidden content is more dangerous than visible content because agents process it but humans cannot see it.

中文简介正在准备中。当前显示原文说明。

Runtime security for agent skills — prevents state corruption, skill overwrite attacks, denial of service, and enforces provenance tracking and no-go repo management. Load as part of the secure-* skill sequence whenever an agent processes external content or writes to the skill store. Also load when the user asks to check for state corruption, prevent skill overwrite, manage no-go repos, check provenance, audit runtime security, detect DoS patterns, or protect the skill store. Covers Issues 6, 9, 10 from the agent security threat model: instruction hierarchy enforcement, state corruption and skill overwrite, and denial of service prevention.

中文简介正在准备中。当前显示原文说明。

Use this skill when the user asks about logging / log hauling operations — short-haul exemption specifics for logging, log truck securement, axle weights, state-by-state logging permits (especially OR, WA, ID, BC), bunk + stake configurations, and how logging fits into FMCSA + state rules. Reference 49 CFR 393 for cargo securement of logs.

中文简介正在准备中。当前显示原文说明。

Use this skill to understand the FMCSA cargo securement standards. Covers § 393.100-§ 393.136 general rules, tiedown requirements, working load limits.

中文简介正在准备中。当前显示原文说明。

Security hardening and best practices for .NET applications. Navigation skill covering OWASP Top 10, authentication, authorization, cryptography, secrets management, and secure coding. For building secure applications. Keywords: security, owasp, authentication, authorization, cryptography, jwt, oauth, secrets, hardening

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.

中文简介正在准备中。当前显示原文说明。

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.

中文简介正在准备中。当前显示原文说明。

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.

中文简介正在准备中。当前显示原文说明。

从认证与权限管理到数据操作、表单、API和生产配置，检查Laravel应用的安全性，并参考实现示例，避免常见漏洞，梳理需要检查的环节。

• 检查登录与权限管理
• 检查查询和输入验证
• 检查表单的CSRF与XSS防护

使用Python和Netmiko自动收集网络设备信息，协助编写或审查SSH脚本，加入连接数量限制、输出解析和错误处理，并为配置变更设置确认步骤。

• 收集多台设备的show命令输出
• 为审计记录接口和路由信息
• 调整SSH脚本的超时设置

检查Django应用的登录、权限、输入处理和生产配置，梳理恶意查询、脚本注入及非预期请求的防护，并审查文件上传、API保护、密钥管理和安全日志。

• 审查登录与用户权限
• 上线前检查生产配置
• 审查输入处理与请求防护

区分Homecore内置原生代码与外部Wasm插件，检查签名、发布者、路径、内存、执行限制和宿主权限，审查插件的安全边界。

• 在安装外部Wasm前进行检查
• 审查内置插件的注册流程
• 检查执行限制和宿主权限

用于检查claude-flow v3的安全设计，梳理威胁与保护范围，完善依赖包、密码存储、认证凭据、输入验证和命令执行方面的措施与测试。

• 梳理安全边界和威胁
• 更新并审计依赖包
• 检查密码存储与认证凭据生成