679 个 · 按相关度排序
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
中文简介正在准备中。当前显示英语简介。
Review web application security across user input, authentication, external services, dependencies, personal data, and AI features. Identify threats, apply protective controls, and verify changes with checks covering access permissions, sensitive information, and untrusted model output.
中文简介正在准备中。当前显示英语简介。
Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.
中文简介正在准备中。当前显示英语简介。
Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.
中文简介正在准备中。当前显示英语简介。
Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.
中文简介正在准备中。当前显示英语简介。
Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.
中文简介正在准备中。当前显示原文说明。
从代码仓库中查找可通过外部请求或用户输入利用的漏洞，追踪输入到危险操作的路径，验证复现步骤与影响，并整理漏洞奖励计划所需的报告依据。
Retrieve current cyber threat data, including malware indicators, addresses of attacker control servers, and vulnerabilities known to be exploited. Filter by threat type, source, severity, and date to identify relevant threats for review and reporting.
中文简介正在准备中。当前显示英语简介。
Assess software dependencies, build pipelines, and container images for security risks. Create a software component inventory, check vulnerabilities and license conflicts, verify artifact signatures, and prioritize fixes based on whether vulnerable code can actually be reached.
中文简介正在准备中。当前显示英语简介。
Analyze a software bill of materials, an inventory of software components, against known vulnerability records. Trace indirect dependencies, assess risk, and produce reports that help teams prioritize fixes and review supplier software.
中文简介正在准备中。当前显示英语简介。
Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.
中文简介正在准备中。当前显示英语简介。
Retrieve security findings from Google Cloud Security Command Center for initial assessment. Filter active vulnerabilities, threats, and external exposures, inspect one finding’s full details, or group counts by category to understand the reported risks.
中文简介正在准备中。当前显示英语简介。
Review source code, dependencies, and infrastructure settings for security issues. Find exposed credentials, unsafe input handling, and access control gaps, then organize findings into a report with severity levels, affected locations, and recommended fixes.
中文简介正在准备中。当前显示英语简介。
Review pull requests, commits, branch differences, or local patches for security vulnerabilities. Inspect changed and deleted text files, trace relevant supporting code, and return validated findings, review comments, and a report describing coverage gaps.
中文简介正在准备中。当前显示英语简介。
Review pull requests, commits, or local changes for security vulnerabilities, including deleted files. Validate potential issues, trace how attacks could reach them, and produce a report showing confirmed findings and gaps in review coverage.
中文简介正在准备中。当前显示英语简介。
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
中文简介正在准备中。当前显示原文说明。
Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation. Use this whenever the user mentions Security Agent, security findings, pentest or penetration test results, code review findings, vulnerabilities found in their AWS account, "what did the security scan find", remediating or triaging security risks, or wants to start fixing reported vulnerabilities — even if they don't name the service explicitly. Trigger it for phrases like "get my security findings", "what vulnerabilities do we have", "let's fix the pentest results", or "triage the security report". The skill discovers scans, exports findings to a gitignored local directory (so sensitive exploit detail is never committed), produces a prioritized triage summary, and offers to start fixing the highest-risk issues.
中文简介正在准备中。当前显示原文说明。
Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm vulnerabilities, ai generated code review, owasp llm, secure ai development, security, ai, llm, owasp, code-review, vulnerabilities" mentioned.
中文简介正在准备中。当前显示原文说明。
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
中文简介正在准备中。当前显示原文说明。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
中文简介正在准备中。当前显示原文说明。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
中文简介正在准备中。当前显示原文说明。
This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
中文简介正在准备中。当前显示原文说明。
为 Quarkus 应用实现并检查身份认证、访问权限和输入验证，同时涵盖机密信息管理、密码哈希、请求限制、审计日志及依赖项已知漏洞检查。
在Django发布或提交变更提案前，依次检查环境、代码质量、数据库变更、测试、漏洞及配置，汇总各阶段是否通过和需要修复的问题。