All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,775
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 12,121–12,144 of 29,775 skills
- Aws CloudformationAuthor, validate, and troubleshoot AWS CloudFormation templates. Covers template authoring with secure defaults, pre-deployment validation (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation.Votes: 0GitHub stars: 10
- Aws Step FunctionsAuthors and edits AWS Step Functions state machines: writes Amazon States Language (ASL) in JSONata, and chooses and structures state types (Task, Choice, Map, Parallel, Pass, Wait, Succeed, Fail). Covers ASL syntax, JSONata data transformation and variables, Retry/Catch error handling, service integrations (.sync, waitForTaskToken callbacks), Distributed Map for large-scale S3/CSV processing, saga/compensation patterns, Standard vs Express workflow choice, TestState API unit testing, and mig...Votes: 0GitHub stars: 10
- Aws Messaging And StreamingGuides general use of AWS messaging and streaming services. Covers Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon MQ, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon Managed Service for Apache Flink, and Amazon Managed Streaming for Apache Kafka (MSK). Use when reasoning about messaging and streaming patterns. In general, use specific skills or documentation searches for detailed service-specific questions. Do NOT use for MSK or Managed Service for Apache Flink questions, pref...Votes: 0GitHub stars: 10
- Threat Model CheckVerify attack prerequisites are realistic. Block unrealistic threat models pre-submission. Matches "threat model", "attack prerequisites", "prereq check"Votes: 0GitHub stars: 6
- Slop CheckMeasure AI slop score (0-10) in reports. Used by triager-sim/reporter. Matches "slop", "AI detection", "ai detection", "template language"Votes: 0GitHub stars: 6
- ScoutUse when firmware binary analysis, attack surface mapping, or endpoint discovery is needed for a targetVotes: 0GitHub stars: 6
- Oos CheckPre-check if a Bug Bounty finding is Out-of-Scope. Auto-triggered at Phase 0 (full scan) and Phase 1 (per-finding). Matches "OOS", "out of scope", "exclusion check"Votes: 0GitHub stars: 6
- Infer Quality Profile From CodeInfer the product's ISO 25010:2023 quality-profile.yaml (characteristic-level targets, security profile, risk register) from scan-index.json during /codify, grounding every characteristic level and every risk entry in concrete scan-index signals and tagging source_type=inferred_from_code. Used exclusively by test-engineer in the /codify play.Votes: 0GitHub stars: 3
- Enrich Capability IceDetail one capability that /vision seeded — promote its capability.md from the directional stage to the detailed stage (benefit hypothesis, boundary, guiding rules, functionalities), author a detailed functionality.md grounding doc for each functionality it identifies, set the capability's structured nfr_needs + compliance_needs, and emit the implied per-dimension levels. Grounded in the capability's KB shelf. Generative artifact production for the /understand play. Under direct-model-write (...Votes: 0GitHub stars: 3
- Derive Quality VisionRead quality-profile, nfr-spec, logical architecture, and physical architecture to produce quality-vision.yaml — a vision statement plus per-ISO-25010-characteristic entries carrying vision narrative, target level, design linkage, concrete named tooling, quantified thresholds, and lifecycle gates. Merges and extends the prior quality-standards artifact.Votes: 0GitHub stars: 3
- Deploy To Cloud EnvDeploy a delivered increment to ONE resolved cloud environment exactly as the slice's run lens (run.yaml) declares it — run the environment's declared deploy command honoring its provider, region, compute, services, and networking; read secrets only from the declared secrets-manager binding (never print or store them); then prove the increment answers with an independent reachability/health check and capture a deploy record (environment, what ran, address, health proof, secrets source). On fa...Votes: 0GitHub stars: 3
- VerboseThreat modeling asks what could go wrong in a design. Vulnerability assessment asks what *is* wrong in the thing you actually built and deployed. The first is predictive and cheap; the second is empirical and finds the gap between the design you modeled and the system you shipped — the misconfigured bucket, the forgotten staging host, the library that went stale.Votes: 0GitHub stars: 2
- MinimalFind actual weaknesses in a built or running system, then triage them by real-world risk so the small number that matter get fixed first.Votes: 0GitHub stars: 2
- VerboseEvery methodology — STRIDE, PASTA, LINDDUN, attack trees — is a technique for answering four questions in order:Votes: 0GitHub stars: 2
- MinimalA structured pass over a design — diagram, trust boundaries, STRIDE, mitigations — that finds whole classes of flaws while they are still cheap to fix.Votes: 0GitHub stars: 2
- VerboseThreat identification fails when it starts from an architecture diagram, because diagrams show components and attackers pursue assets. Build the asset register first and rate each on confidentiality, integrity, and availability separately.Votes: 0GitHub stars: 2
- MinimalEnumerate what could go wrong in a system before deciding what to do about it — inventory the assets worth attacking, the entry points that reach them, and the actors who would try.Votes: 0GitHub stars: 2
- VerboseEvery category of tool has a blind spot that follows from its mechanism, not from its quality. Buying a better product in the same category does not close it.Votes: 0GitHub stars: 2
- MinimalChoose and place automated security tools so each covers a class of defect the others structurally cannot, without drowning the pipeline in false positives.Votes: 0GitHub stars: 2
- VerboseYou cannot review what you cannot see. Before any judgment, produce four artifacts:Votes: 0GitHub stars: 2
- MinimalEvaluate a system's design — its trust boundaries, data flows, and blast radius — to find flaws that no amount of correct code at the line level can fix.Votes: 0GitHub stars: 2
- VerboseEvery review starts the same way: enumerate the sources of attacker-controlled data, enumerate the dangerous sinks, and ask whether anything sanitizing sits between them.Votes: 0GitHub stars: 2
- MinimalRead code as an attacker would, at the line level, and find the flaws scanners structurally cannot see — missing authorization, broken business logic, misused crypto.Votes: 0GitHub stars: 2
- VerboseAlmost every object-storage mistake comes from carrying filesystem instincts into a system that only superficially resembles one. Object storage (S3, GCS, Azure Blob) is a flat map from a string key to an immutable blob of bytes, reached over HTTP. That is the whole model. What looks like a directory tree is an illusion the tooling paints over a flat namespace.Votes: 0GitHub stars: 2