693 个 · 按相关度排序
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
中文简介正在准备中。当前显示英语简介。
Understand a codebase before searching for bugs or vulnerabilities. This skill examines functions line by line, documents assumptions and state changes, and traces calls across modules to build an evidence-based picture of system behavior.
中文简介正在准备中。当前显示英语简介。
Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.
中文简介正在准备中。当前显示英语简介。
Implement and review API security within an application's existing authentication and data model. Covers token verification, resource permissions, input validation, request limits, secrets, and logging, with concrete checks for unauthorized access and invalid requests.
中文简介正在准备中。当前显示英语简介。
Review GitHub Actions workflows that run AI agents, tracing how external input reaches prompts and tools. Produce findings with evidence, severity, impact, and remediation guidance through static analysis, which examines configuration without running attacks.
中文简介正在准备中。当前显示英语简介。
Review Git changes with the ocr command-line tool and a configured AI model. Get line-level findings grouped by severity for working changes, commits, or branch comparisons, with code fixes applied when explicitly requested.
中文简介正在准备中。当前显示英语简介。
Coordinate authorized penetration testing with tools for port discovery, vulnerability scanning, web testing, and password hash recovery. Use MCP servers to connect agents to security tools, record reproducible evidence, and support reporting within the approved scope.
中文简介正在准备中。当前显示英语简介。
Assess security in authorized cloud, container, and Kubernetes environments. Review excessive permissions, exposed resources, container isolation, and cluster access controls, then document findings with reproduction details and their impact.
中文简介正在准备中。当前显示英语简介。
Assess industrial control systems by mapping devices, network zones, and exposed protocols. The workflow prioritizes observing traffic and read-only checks, then organizes evidence about configuration weaknesses, firmware vulnerabilities, and potential effects on physical processes.
中文简介正在准备中。当前显示英语简介。
Plan and carry out major library and framework upgrades by checking compatibility, identifying changes that require code updates, testing each stage, and preparing rollback steps if an upgrade causes problems.
中文简介正在准备中。当前显示英语简介。
Review AI prompts for harmful output risks, bias, privacy concerns, security weaknesses, and clarity. Receive an assessment, a revised prompt, and suggested tests with explanations of the principles behind each improvement.
中文简介正在准备中。当前显示英语简介。
Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.
中文简介正在准备中。当前显示英语简介。
Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.
中文简介正在准备中。当前显示英语简介。
Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.
中文简介正在准备中。当前显示英语简介。
Strengthen LDAP and Active Directory services by reviewing encrypted connections, signing, channel binding, access controls, and audit logging. Use the guidance to organize security settings, validate them in a test environment, and document implementation evidence.
中文简介正在准备中。当前显示英语简介。
Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.
中文简介正在准备中。当前显示英语简介。
Build a recurring vulnerability scanning process with Nessus, Qualys, or OpenVAS. Prioritize findings using asset importance and known exploitation, then organize remediation deadlines, monitoring dashboards, and automatic tickets for urgent issues.
中文简介正在准备中。当前显示英语简介。
Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.
中文简介正在准备中。当前显示英语简介。
Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.
中文简介正在准备中。当前显示英语简介。
Assess security risks in AI systems by scanning prompts for known attack patterns and scoring data exposure, poisoning, and tool abuse risks. Map findings to MITRE ATLAS, an AI threat framework, and identify protective controls.
中文简介正在准备中。当前显示英语简介。
Review code changes for newly introduced security issues with a plausible attack path. Produce findings for the Warden security summary, including affected lines, severity, a minimal fix, and observable conditions for confirming the issue is resolved.
中文简介正在准备中。当前显示英语简介。
Strengthen existing tests with fast-check by checking properties across generated inputs. Find bugs that example tests miss and reduce failing inputs to small, reproducible cases. Property testing is available; the other listed workflows remain planned.
中文简介正在准备中。当前显示英语简介。
Assess Web3 vulnerability findings before submission by checking scope, reproducibility, prerequisites, and attack costs. Organize the root cause, measurable impact, working proof of concept, and proposed fix into an Immunefi report, with examples for comparison.
中文简介正在准备中。当前显示英语简介。
Build runnable Foundry tests that demonstrate smart contract vulnerabilities with before-and-after logs and assertions. Use fork tests, which copy blockchain state, and test helpers to reproduce known DeFi incidents or prepare evidence for a report.
中文简介正在准备中。当前显示英语简介。