704 个 · 按相关度排序
Investigate how a limited Linux account could gain root, the system administrator's privileges. The skill guides checks of permissions, scheduled tasks, services, and known vulnerabilities, while outlining evidence defenders can monitor during authorized security assessments.
中文简介正在准备中。当前显示英语简介。
Assess dependency confusion, where a build retrieves a public package instead of an intended private one. Discover internal package names, review registry settings, plan callback-based proofs of execution, and document fixes across major package ecosystems.
中文简介正在准备中。当前显示英语简介。
Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.
中文简介正在准备中。当前显示英语简介。
Adapt a C/C++ vulnerability pipeline to another language, target, or detection method. The workflow gathers requirements, proposes file changes for approval, updates the implementation, and validates it against a test target containing known bugs.
中文简介正在准备中。当前显示英语简介。
Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.
中文简介正在准备中。当前显示英语简介。
Review code for readability, security weaknesses, performance bottlenecks, test quality, and ease of maintenance. Receive findings grouped by importance, with explanations and concrete suggestions that reflect the project's context and constraints.
中文简介正在准备中。当前显示英语简介。
Submit security scans for AI services, tools, skills, and agents through AI-Infra-Guard, then retrieve progress and results. It also supports jailbreak evaluation, testing whether prompts can bypass a model’s safety restrictions.
中文简介正在准备中。当前显示英语简介。
Collect Amazon product data from ASINs, unique product identifiers, and compare prices, specifications, reviews, and product images. Produce comparison tables and reports that highlight competitive strengths, weaknesses, and potential market opportunities.
中文简介正在准备中。当前显示英语简介。
Run a quick code security review for exposed credentials, injection risks, unsafe page content, vulnerable dependencies, and authentication issues. Receive findings grouped by severity, with file locations and suggested fixes to prioritize remediation.
中文简介正在准备中。当前显示英语简介。
Routes security work to specialized guides for web and API testing, code review, threat intelligence, and incident response. Helps organize assessments from both attack and defense perspectives, including coordinated testing of detection capabilities.
中文简介正在准备中。当前显示英语简介。
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
中文简介正在准备中。当前显示英语简介。
Find test inputs and filter bypass examples for web security checks, organized by vulnerability type. Includes URL classification patterns, discovery wordlists, and examples of combining findings to demonstrate concrete security impact.
中文简介正在准备中。当前显示英语简介。
Turn validated vulnerabilities into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Platform templates help organize demonstrated impact, reproducible steps, supporting evidence, severity reasoning, and concrete fixes in language reviewers can follow.
中文简介正在准备中。当前显示英语简介。
Review EVM and Solana meme coins for hidden minting, blocked sales, adjustable fees, and liquidity withdrawal risks. The skill guides source checks and on-chain verification to identify privileged controls that could enable a rug pull.
中文简介正在准备中。当前显示英语简介。
Investigate XXE, an XML parsing flaw, in APIs and document uploads. The skill guides entry point discovery, external callback checks, and evidence collection to establish whether files or internal services are actually exposed.
中文简介正在准备中。当前显示英语简介。
Investigate cross-site scripting, where untrusted input executes as JavaScript in a web page. Check reflected, stored, and browser-side cases, distinguish escaped output from executable content, and validate reproducible behavior and user impact before reporting.
中文简介正在准备中。当前显示英语简介。
Assess WebSocket security in chat, notifications, and other live features. The skill covers connection checks, message permissions, tampering, and access to private channels, with validation steps to distinguish actual data exposure or state changes from misleading responses.
中文简介正在准备中。当前显示英语简介。
Inspect TLS certificates, DNS records, and email authentication settings, then separate configuration advice from demonstrable vulnerabilities. The skill guides evidence collection and impact assessment for subdomain takeover, client certificate bypass, internal hostname exposure, and email spoofing.
中文简介正在准备中。当前显示英语简介。
Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.
中文简介正在准备中。当前显示英语简介。
Investigate SSRF, where supplied URLs cause unintended server requests, in previews, imports, proxies, and PDF generation. Confirm outbound connections, identify the responsible input, and establish whether internal services or sensitive responses are accessible.
中文简介正在准备中。当前显示英语简介。
Investigate SQL injection in search forms, filters, and APIs by choosing tests based on actual responses. The skill covers visible query results, response differences, and timing evidence, helping produce reproducible reports with concrete data impact.
中文简介正在准备中。当前显示英语简介。
Assess on-premises SharePoint Server for exposed information, legacy login paths, and conditions associated with known vulnerabilities. It guides evidence collection and helps distinguish meaningful security findings from misleading error messages.
中文简介正在准备中。当前显示英语简介。
Assess session management weaknesses, including sessions that survive logout or password changes, fixed session IDs, and refresh-token reuse. The skill uses two real sessions, response-body comparisons, and control checks to distinguish continued account access from misleading successful responses.
中文简介正在准备中。当前显示英语简介。
Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.
中文简介正在准备中。当前显示英语简介。