20 个 · 按相关度排序
Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.
中文简介正在准备中。当前显示英语简介。
Turn Trail of Bits Testing Handbook content into Claude Code skills for security testing. Creates or refreshes SKILL.md files using templates for tools, fuzzers, techniques, and subject areas, then validates structure and links between skills.
中文简介正在准备中。当前显示英语简介。
Reviews application security and guides AppSec design. Use when reviewing auth, authentication, authorization, sessions, data handling, supply chain, or AppSec architecture.
中文简介正在准备中。当前显示原文说明。
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
中文简介正在准备中。当前显示英语简介。
Analyze a codebase to identify valuable assets, attack entry points, and realistic abuse paths. Produce a concise Markdown threat model that explains risk priorities, distinguishes existing protections from proposed mitigations, and makes assumptions explicit.
中文简介正在准备中。当前显示英语简介。
Create a Markdown threat model grounded in a codebase. Identify valuable assets, boundaries between trusted and untrusted components, realistic attack paths, and mitigations, then prioritize risks using explicit assumptions about likelihood and impact.
中文简介正在准备中。当前显示英语简介。
Prepare one Markdown article for both WeChat drafts and RedNote posts. The skill formats long articles, uploads images, converts content into shorter social posts with tags, and provides previews and batch processing.
中文简介正在准备中。当前显示英语简介。
Prepare Markdown or HTML content for a WeChat Official Account and save articles as drafts through an API or browser. It also supports short image posts, article themes, and checks for titles, summaries, and cover images.
中文简介正在准备中。当前显示英语简介。
Plan welcome messages and customer-service replies for WeChat official accounts, including triggers and handoff rules. Send customer-service text to a specified recipient only after the user confirms the target and message.
中文简介正在准备中。当前显示英语简介。
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
中文简介正在准备中。当前显示原文说明。
Multi-agent source security audit with a coverage ledger, independently verified findings, and machine-checked records. Use when asked to audit a codebase, find vulnerabilities, or run a source-level pen test.
中文简介正在准备中。当前显示原文说明。
Create a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.
中文简介正在准备中。当前显示原文说明。
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, SSRF. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' or wants to check their codebase for common security weaknesses.
中文简介正在准备中。当前显示原文说明。
Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.
中文简介正在准备中。当前显示原文说明。
Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.
中文简介正在准备中。当前显示原文说明。
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.
中文简介正在准备中。当前显示原文说明。
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
中文简介正在准备中。当前显示原文说明。
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.
中文简介正在准备中。当前显示原文说明。
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Use when the user explicitly asks to threat model a codebase or path, enumerate abuse paths, or perform AppSec threat modeling.
中文简介正在准备中。当前显示原文说明。
Performs a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
中文简介正在准备中。当前显示原文说明。