All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,147
- 1,298
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 15,145–15,168 of 31,147 skills
- Cyber Securing Remote Access To Ot EnvironmentThis skill covers implementing secure remote access to OT/ICS environments for operators, engineers, and vendors while preventing unauthorized access that could compromise industrial operations. It addresses jump server architecture, multi-factor authentication, session recording, privileged access management, vendor remote access controls, and compliance with IEC 62443 and NERC CIP-005 remote accVotes: 0GitHub stars: 2
- Cyber Securing Github Actions WorkflowsThis skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.Votes: 0GitHub stars: 2
- Cyber Securing Container Registry With HarborHarbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replicatioVotes: 0GitHub stars: 2
- Cyber Scanning Infrastructure With NessusTenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.Votes: 0GitHub stars: 2
- Cyber Scanning Docker Images With TrivyTrivy is a comprehensive open-source vulnerability scanner by Aqua Security that detects vulnerabilities in OS packages, language-specific dependencies, misconfigurations, secrets, and license violatiVotes: 0GitHub stars: 2
- Cyber Reverse Engineering Ios App With FridaReverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for reVotes: 0GitHub stars: 2
- Cyber Prioritizing Vulnerabilities With Cvss ScoringThe Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (rVotes: 0GitHub stars: 2
- Cyber Performing Authenticated Scan With OpenvasConfigure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.Votes: 0GitHub stars: 2
- Cyber Performing Api Security Testing With PostmanUses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD securityVotes: 0GitHub stars: 2
- Cyber Performing Api Fuzzing With RestlerUses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and find security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes resultsVotes: 0GitHub stars: 2
- Cyber Performing Android App Static Analysis With MobsfPerforms automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD secuVotes: 0GitHub stars: 2
- Cyber Performing Active Directory Penetration TestConduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.Votes: 0GitHub stars: 2
- Cyber Intercepting Mobile Traffic With BurpsuiteIntercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, BVotes: 0GitHub stars: 2
- Cyber Implementing Aqua Security For Container ScanningDeploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.Votes: 0GitHub stars: 2
- Cyber Implementing Api Threat Protection With ApigeeImplement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.Votes: 0GitHub stars: 2
- Cyber Implementing Api Key Security ControlsImplements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. ActivatesVotes: 0GitHub stars: 2
- Cyber Implementing Api Gateway Security ControlsImplements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend seVotes: 0GitHub stars: 2
- Cyber Hardening Windows Endpoint With Cis BenchmarkHardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO securityVotes: 0GitHub stars: 2
- Cyber Hardening Linux Endpoint With Cis BenchmarkHardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baseVotes: 0GitHub stars: 2
- Cyber Hardening Docker Daemon ConfigurationHarden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.Votes: 0GitHub stars: 2
- Cyber Extracting Credentials From Memory DumpExtract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.Votes: 0GitHub stars: 2
- Cyber Exploiting Zerologon Vulnerability Cve 2020 1472[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.Votes: 0GitHub stars: 2
- Cyber Exploiting Websocket Vulnerabilities[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.Votes: 0GitHub stars: 2
- Cyber Exploiting Vulnerabilities With Metasploit Framework[LAB-GATED; discovery is not runtime authorization; offensive/dual-use — authorized-lab gate] The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modulesVotes: 0GitHub stars: 2