“vulnerabilities”的搜索结果

Implement application security controls, including login, access permissions, password hashing, and input validation. The skill provides code, configuration requirements, and testing guidance for checking protections against unauthorized access, malicious input, and sensitive data exposure.

中文简介正在准备中。当前显示英语简介。

• Implementing login with password hashing and rate limits
• Adding JWT validation and session protection
• Preventing SQL injection and malicious script execution

Review code changes and files for bugs, security risks, performance problems, design issues, and test coverage. Receive a structured report with prioritized findings, concrete improvement examples, positive feedback, and an overall review verdict.

中文简介正在准备中。当前显示英语简介。

• Reviewing a pull request
• Auditing code quality and security
• Finding refactoring opportunities

Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.

中文简介正在准备中。当前显示英语简介。

• Prioritizing outdated dependencies
• Separating security fixes by severity
• Identifying major updates needing human review

Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.

中文简介正在准备中。当前显示英语简介。

• Find structural causes shared by several vulnerabilities
• Compare security architecture options and costs
• Explain proposed changes with before-and-after diagrams

Inspect repository code or code changes for plausible security vulnerabilities. The skill records candidate issues with affected locations, attacker-controlled inputs, failing safeguards, and possible impact, preserving the evidence needed for later validation.

中文简介正在准备中。当前显示英语简介。

• Finding security issues that may arise from code changes
• Investigating vulnerability candidates in repository code
• Organizing source evidence for later validation

Review code or changes for exposed secrets, injection risks, weak encryption, and missing permission checks. Produce a structured report with severity, location, recommendations, and confidence, with a separate reviewer checking findings for false positives.

中文简介正在准备中。当前显示英语简介。

• Reviewing a module for security issues
• Checking changes for exposed secrets
• Preparing a vulnerability report with evidence

Review code changed during a project phase for bugs, security vulnerabilities, and quality issues. Choose the review depth or specific files, receive findings grouped by severity, and optionally apply fixes followed by another review.

中文简介正在准备中。当前显示英语简介。

• Reviewing code changed during a phase
• Checking selected source files
• Examining interactions across files

Review codebases, APIs, and tools for vulnerabilities using source evidence and bounded local checks. Produces supported findings with impact, priority, and focused fixes, and can create structured reports for explicitly requested full audits.

中文简介正在准备中。当前显示英语简介。

• Review security concerns in specific code
• Investigate a suspected vulnerability
• Audit a codebase and produce reports

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

中文简介正在准备中。当前显示英语简介。

• Reviewing workflows that run AI coding agents
• Tracing issue and PR content into agent prompts
• Checking sandbox settings and user allowlists

Review Solana and Anchor programs for six security patterns, including unsafe calls to other programs and missing account checks. Receive a complete coverage table, findings with file references and severity, and suggested fixes for identified issues.

中文简介正在准备中。当前显示英语简介。

• Reviewing Solana programs before launch
• Checking calls to other programs and their program IDs
• Inspecting address derivation and account validation

Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.

中文简介正在准备中。当前显示英语简介。

• Review StarkNet contracts before launch
• Audit L1-L2 bridge message handling
• Check protection against signature reuse

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.

中文简介正在准备中。当前显示英语简介。

• Reviewing a pull request for security risks
• Checking whether a fixed bug has returned
• Assessing which callers a change could affect

Inspects compiled instructions and bytecode to identify timing risks in cryptographic code. Helps trace flagged operations back to secret data, distinguish false positives, and review fixes across compiler settings and target architectures.

中文简介正在准备中。当前显示英语简介。

• Reviewing signing and encryption routines
• Checking division involving secret values
• Inspecting authentication tag comparisons

Review native C/C++ applications and services for memory errors, integer overflows, and race conditions, where concurrent operations interfere. Coordinate multiple reviewers and produce findings with severity ratings, alongside reports of missing or unverified review coverage.

中文简介正在准备中。当前显示英语简介。

• Audit a native C/C++ application for security flaws
• Review a daemon or service for memory safety
• Investigate integer overflows and race conditions

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Evaluate older Wi-Fi clients and embedded devices for KRACK and FragAttacks vulnerabilities. Covers test suites, likely patch status, practical impact, and reporting findings by device, firmware version, and vulnerability identifier.

中文简介正在准备中。当前显示英语简介。

• Assessing older Wi-Fi clients
• Reviewing IoT firmware patch status
• Distinguishing KRACK and FragAttacks impacts

Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.

中文简介正在准备中。当前显示英语简介。

• Assessing Linux privilege escalation paths
• Practicing privilege escalation in CTF challenges
• Reviewing sudo and scheduled task configurations

Assess how applications use encryption, signed tokens, and random values. Identify implementation weaknesses, select relevant testing tools, and document causes and fixes for issues involving encryption modes, RSA parameters, predictable randomness, and key derivation.

中文简介正在准备中。当前显示英语简介。

• Assessing encrypted cookies and tokens
• Checking RSA keys and cryptographic settings
• Testing session token predictability

Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.

中文简介正在准备中。当前显示英语简介。

• Check access controls across users and roles
• Review token lifecycles and request limits
• Assess gRPC and WebSocket security

Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing server protocols, encryption settings, and certificates
• Reviewing certificate validation in mobile apps
• Assessing TLS 1.3 replay risks and mutual authentication

Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.

中文简介正在准备中。当前显示英语简介。

• Reviewing package registry settings in CI/CD
• Finding internal package names in lock files
• Planning an authorized callback-based proof of concept

Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.

中文简介正在准备中。当前显示英语简介。

• Inspecting APK or IPA files for endpoints and embedded secrets
• Observing app behavior and traffic with Frida
• Reviewing deep links and externally accessible components