All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,246
- 1,219
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 3,193–3,216 of 29,246 skills
- Ashrafiucse Secrets DetectionFinds hardcoded secrets in any project — API keys (AWS, GitHub, Google, Stripe, Slack), passwords, tokens, private keys, JWTs, database URLs with credentials. Runs a fast regex scan, then triages matches to remove false positives and checks .env/git hygiene. Use when auditing a codebase for leaked credentials or before committing/publishing a repo.Votes: 0GitHub stars: 76
- Ashrafiucse Rails SecurityAudits Ruby on Rails applications for framework-specific vulnerabilities — SQL injection via interpolated where/order/find_by_sql, mass assignment through params.permit!, XSS via raw/html_safe/<%==, CSRF skips (protect_from_forgery absent, skip_before_action), missing authenticate/authorize before_actions, send_file/IO path traversal, open redirects via redirect_to(params), Marshal/Oj unsafe deserialization, send/public_send with params, committed secret_key_base, and force_ssl disabled. Use ...Votes: 0GitHub stars: 76
- Ashrafiucse Laravel SecurityAudits Laravel (PHP) applications for framework-specific vulnerabilities — mass assignment via missing fillable/guarded, SQL injection through DB::raw/whereRaw/orderByRaw concatenation, Blade raw output XSS, CSRF middleware exclusions, committed APP_KEY enabling cookie-forgery RCE chains, APP_DEBUG in production, routes without auth middleware, path traversal in file downloads, and dev tools (debugbar/telescope) in production dependencies. Use when the project has composer.json with laravel/f...Votes: 0GitHub stars: 76
- Ashrafiucse Graphql SecurityAudits GraphQL APIs for security misconfiguration and abuse — introspection/GraphiQL/playground exposed in production, missing query depth and complexity limits, resolver-level authorization gaps and IDOR, error/stacktrace/field-suggestion leakage, query-batching abuse, CSRF with cookie auth, and unbounded custom scalars. Covers Apollo, graphql-yoga, express-graphql, graphql-js, graphene/strawberry/ariadne, gqlgen, Hasura. Use when the project has a GraphQL server, .graphql schema files, or G...Votes: 0GitHub stars: 76
- Ashrafiucse Flow SecurityAudits multi-step business flows for vulnerabilities that are invisible when endpoints are checked in isolation — order/payment/invoice state-machine violations, cross-step data provenance (stale or client-supplied totals at terminal steps), chained/association IDOR (ownership through entity joins), replay and duplication across steps, step-skipping via direct access, post-payment mutation, amount drift, and privilege transitions between hops. Use when the app has stateful workflows (checkout...Votes: 0GitHub stars: 76
- Ashrafiucse Django SecurityAudits Django (Python) applications for framework-specific vulnerabilities — raw()/extra() SQL injection, mark_safe and |safe filter XSS, SSTI via Template() with user strings, ModelForm fields='__all__' mass assignment, settings misconfigurations (DEBUG=True, ALLOWED_HOSTS=['*'], insecure cookie flags, hardcoded SECRET_KEY), missing login_required/permission checks (IDOR), weak password hashers, and django-cors-headers wildcards. Use when the project has manage.py, settings.py, or Django in ...Votes: 0GitHub stars: 76
- Ashrafiucse Data ExposureFinds sensitive data exposure risks — PII/secrets written to logs, over-returning API responses, data at rest without encryption, sensitive data in URLs, test fixtures with real data, secrets in git history, and temporary/backup file leaks. Use when auditing how a project handles, stores, logs, or transmits sensitive data.Votes: 0GitHub stars: 76
- Ashrafiucse Cve ResearchResearches current, publicly known vulnerabilities (CVEs) affecting a project's exact stack and versions — queries OSV.dev and the CISA Known Exploited Vulnerabilities catalog live, and reads the bundled, versioned vuln knowledge base for detection guidance. Use when checking whether a project is affected by newly disclosed CVEs, or when maintaining/updating the security-skills knowledge base.Votes: 0GitHub stars: 76
- Ashrafiucse Crypto ReviewFinds cryptographic weaknesses in code — weak ciphers (DES, RC4, ECB mode), weak hashes (MD5, SHA-1) used for security purposes, hardcoded keys/IVs/salts, predictable randomness (Math.random, random, time-based tokens), disabled certificate verification, and undersized key lengths. Use when auditing anything involving encryption, hashing, tokens, certificates, or random number generation.Votes: 0GitHub stars: 76
- Ashrafiucse Config HardeningAudits configuration security in any project — HTTP security headers, CORS policy, cookie flags, TLS settings, debug modes in production configs, default credentials, exposed admin/debug endpoints, CI/CD pipeline risks (GitHub Actions, GitLab CI), and exposed sensitive files. Use when auditing web server, framework, reverse proxy, or CI configuration files.Votes: 0GitHub stars: 76
- Ashrafiucse Auth ReviewReviews authentication and authorization in any codebase — login flows, password storage, session/cookie handling, JWT pitfalls, OAuth/OIDC misconfigurations, IDOR/broken access control, privilege escalation, CSRF protection, route census for unguarded endpoints, trusted-header identity spoofing, check-then-act race conditions (TOCTOU), and WebSocket/SSE authorization. Use when auditing how users log in, how permissions are enforced, how internal services trust each other, or when reviewing a...Votes: 0GitHub stars: 76
- Ianalloway Sports OddsGet live sports betting odds and compare lines across sportsbooks. Supports NFL, NBA, MLB, NHL, and more.Votes: 0GitHub stars: 76
- Ianalloway Security ScannerScan code and dependencies for security vulnerabilities. Check npm audit, pip safety, and common security issues.Votes: 0GitHub stars: 76
- Ianalloway Judge AuditAudit an LLM-as-judge with juryrig — position bias, verbosity bias, prompt injection, consistency, and calibration via CLI or HttpJudge.Votes: 0GitHub stars: 76
- Offensive NetexecUse this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoasting, lateral movement, BloodHound collection, module usage, or any pentest workflow involving Wi...Votes: 0GitHub stars: 6,704
- Laravel SecurityLaravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥管理、速率限制和安全部署。Votes: 0GitHub stars: 3
- Generate ReportGenerate a structured Markdown report with YAML frontmatter for repository health monitoring. Use when the user asks to create a report, health check, audit, scan result, or status update for a repository.Votes: 0GitHub stars: 10
- Threat ModelingIdentify and analyze security threats. Use when designing systems, reviewing architecture, or assessing risk. Covers STRIDE methodology.Votes: 0GitHub stars: 34
- Security ReviewConduct security code reviews. Use when reviewing code for vulnerabilities, assessing security posture, or auditing applications. Covers security review checklist.Votes: 0GitHub stars: 34
- Identity AccessImplement identity and access management. Use when designing authentication, authorization, or user management. Covers OAuth2, OIDC, and RBAC.Votes: 0GitHub stars: 34
- ComplianceEnsure regulatory compliance. Use when implementing GDPR, HIPAA, PCI-DSS, or SOC2 requirements. Covers compliance frameworks and controls.Votes: 0GitHub stars: 34
- Application SecuritySecure applications against common vulnerabilities. Use when reviewing code for security, implementing security controls, or hardening applications. Covers OWASP Top 10.Votes: 0GitHub stars: 34
- Dependency ManagementManage project dependencies effectively. Use when adding, updating, or auditing dependencies. Covers version management, security scanning, and lockfiles.Votes: 0GitHub stars: 34
- Defense In DepthApply layered security architecture. Use when designing security controls, hardening systems, or reviewing security posture. Covers multiple security layers.Votes: 0GitHub stars: 34