access-control
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-23 00:13
Security & auditing
7,319 results
api
This skill should be used when the user asks to "check API security", "audit REST API", "find BOLA vulnerabilities", "check for mass assignment", "analyze API…
config
This skill should be used when the user asks to "configure security", "appsec settings", "security preferences", or invokes /appsec:config. Manages security…
data-disclosure
This skill should be used when the user asks to "check for personal data disclosure", "analyze PII exposure", "find privacy issues related to data leakage",…
pasta
This skill should be used when the user asks to "run PASTA analysis", "PASTA threat model", "risk-centric threat analysis", or invokes /appsec:pasta.…
threat-modeling
Conduct systematic threat modeling using STRIDE framework, attack trees, and security architecture analysis for CIA platform
compliance-checklist
Unified compliance mapping across ISO 27001:2022, NIST CSF 2.0, CIS Controls v8.1, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, HIPAA
open-source-governance
Open source policy, license compliance, contribution guidelines, dependency management, and supply chain security
static-site-security
Security best practices specifically for static HTML/CSS websites on GitHub Pages
solidity
Solidity language and compiler — source layout, types, contracts, control flow, security, compiler, ABI, internals.
sonarqube-audit
The English introduction is being prepared.
springboot-security
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
finding-discipline
Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report
threat-model-discipline
Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed…
command-injection-anti-pattern
Security anti-pattern for OS Command Injection vulnerabilities (CWE-78). Use when generating or reviewing code that executes shell commands, runs system…
depscan
Run OWASP Depscan for advanced Software Composition Analysis with VDR, CSAF, and license compliance. Use when scanning dependencies with deep SCA, generating…
encrypted-tunnel-pattern
Security pattern for channel-level encryption (TLS/SSH). Use when implementing HTTPS, securing all communication between endpoints, setting up TLS connections,…
encryption-pattern
Security pattern for implementing encryption and decryption operations. Use when encrypting data for confidentiality, selecting encryption algorithms (AES,…
excessive-data-exposure-anti-pattern
Security anti-pattern for excessive data exposure (CWE-200). Use when generating or reviewing API responses, database queries, or data serialization. Detects…
ldap-injection-anti-pattern
Security anti-pattern for LDAP injection vulnerabilities (CWE-90). Use when generating or reviewing code that constructs LDAP filters, queries directory…
length-extension-attacks-anti-pattern
Security anti-pattern for hash length extension vulnerabilities (CWE-328). Use when generating or reviewing code that uses hash(secret + message) for…
log-injection-anti-pattern
Security anti-pattern for log injection vulnerabilities (CWE-117). Use when generating or reviewing code that writes to log files, handles logging of user…
mass-assignment-anti-pattern
Security anti-pattern for mass assignment vulnerabilities (CWE-915). Use when generating or reviewing code that creates or updates objects from user input,…
padding-oracle-anti-pattern
Security anti-pattern for padding oracle vulnerabilities (CWE-649). Use when generating or reviewing code that decrypts CBC-mode ciphertext, handles decryption…