“vulnerabilities”的搜索结果

Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.

中文简介正在准备中。当前显示原文说明。

Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.

中文简介正在准备中。当前显示原文说明。

Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.

中文简介正在准备中。当前显示原文说明。

Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection testing, SQLi in APIs, NoSQL injection, SSRF testing, or API input validation assessment.

中文简介正在准备中。当前显示原文说明。

Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.

中文简介正在准备中。当前显示原文说明。

Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.

中文简介正在准备中。当前显示原文说明。

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.

中文简介正在准备中。当前显示原文说明。

使用AgentShield检查Claude Code配置，报告硬编码秘密信息、权限过宽和恶意指令注入等风险，生成含严重程度与评级的报告，并自动修复部分问题。

• 启用Claude Code时检查配置
• 权限或MCP配置更改后审计
• 加入仓库时检查已有配置

检查Java Spring Boot服务的身份认证、访问权限和输入验证等安全措施，涵盖秘密信息管理、日志、API调用频率限制及依赖库漏洞。

• 添加身份认证和访问权限
• 检查API输入验证和SQL构造
• 核查CSRF和CORS配置

审查代码与配置中的安全问题，记录攻击路径、影响依据、调查范围和待确认事项。具备受支持的环境时，还可在隔离环境中复现问题并提出修复候选方案。

• 调查代码与配置中的漏洞
• 审查分支改动的安全性
• 复现漏洞并研究修复候选方案

Check a codebase for known dependency vulnerabilities, hard-coded secrets, and risky code patterns using Ruflo security tools. Choose a scan depth, inspect matching lines, and report verified concerns with a clear account of what was checked.

中文简介正在准备中。当前显示英语简介。

• Checking pull requests for security regressions
• Inspecting authentication and input-handling code for risky patterns
• Running security checks before production deployment

Benchmark security detection systems against 10 known vulnerabilities and nine harmless decoys. Compare four approaches, including an evolved champion, and receive structured JSON covering detection, false alarms, patch tests, reproduction, unsafe outputs, and overall pass or fail.

中文简介正在准备中。当前显示英语简介。

• Comparing security detection approaches
• Tracking changes in detection and false alarms
• Flagging failed checks in scheduled benchmarks

Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.

中文简介正在准备中。当前显示英语简介。

• Checking dependencies before a production deployment
• Investigating a reported package vulnerability
• Adding automated dependency scanning to CI

Assess an application against OWASP Top 10:2025 risk categories using Strix. Get findings backed by working exploit examples, organized by category, with clear explanations of what was tested and what remains unassessed.

中文简介正在准备中。当前显示英语简介。

• Assessing an app against OWASP Top 10:2025
• Testing access controls across users and tenants
• Organizing proven vulnerabilities by risk category

Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.

中文简介正在准备中。当前显示英语简介。

• Testing an API from its specification
• Checking data access across tenants
• Verifying restrictions on administrator routes

Run security tests for web apps, APIs, and source code on Strix Cloud without local Docker or an LLM key. Register targets, review findings in a team dashboard, export results, and configure recurring scans or PR reviews.

中文简介正在准备中。当前显示英语简介。

• Running security tests without local Docker
• Tracking vulnerability status across a team
• Scheduling scans and starting PR security reviews

Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.

中文简介正在准备中。当前显示英语简介。

• Security testing a staging web application
• Checking access between accounts and organizations
• Testing a local development server

Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.

中文简介正在准备中。当前显示英语简介。

• Planning an authorized penetration test
• Coordinating specialist assessment skills
• Evaluating the impact of linked vulnerabilities

Understand a codebase before searching for bugs or vulnerabilities. This skill examines functions line by line, documents assumptions and state changes, and traces calls across modules to build an evidence-based picture of system behavior.

中文简介正在准备中。当前显示英语简介。

• Understanding a codebase before a security audit
• Tracing data and state changes across function calls
• Documenting assumptions for an architecture review

Implement and review API security within an application's existing authentication and data model. Covers token verification, resource permissions, input validation, request limits, secrets, and logging, with concrete checks for unauthorized access and invalid requests.

中文简介正在准备中。当前显示英语简介。

• Add authentication and permissions to an API endpoint
• Check access across users and tenant organizations
• Validate request inputs and reject extra fields

Review GitHub Actions workflows that run AI agents, tracing how external input reaches prompts and tools. Produce findings with evidence, severity, impact, and remediation guidance through static analysis, which examines configuration without running attacks.

中文简介正在准备中。当前显示英语简介。

• Auditing AI agent integrations in GitHub Actions
• Tracing issue and PR text into agent prompts
• Reviewing sandbox settings and tool permissions

Review Git changes with the ocr command-line tool and a configured AI model. Get line-level findings grouped by severity for working changes, commits, or branch comparisons, with code fixes applied when explicitly requested.

中文简介正在准备中。当前显示英语简介。

• Reviewing changes before a commit
• Checking a pull request or branch comparison
• Inspecting a specific commit for issues