All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,842
- 1,327
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 18,193–18,216 of 31,842 skills
- Age Verification MethodsEvaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.Votes: 0GitHub stars: 264
- Age Gating ServicesImplements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.Votes: 0GitHub stars: 264
- Llm Output Privacy RiskAssessing privacy risks in large language model outputs including training data memorisation, PII leakage in generated text, prompt injection leading to data extraction, and hallucinated personal data. Covers output filtering, guardrails, and monitoring. Keywords: LLM privacy, output risk, memorisation, PII leakage, prompt injection, hallucinated PII.Votes: 0GitHub stars: 264
- Ai Vendor Privacy DueDetermines controller-processor relationships for AI services and conducts privacy due diligence. Covers SaaS AI (processor), embedded AI (joint controller), API-based AI (assessment framework), and vendor risk assessment. Keywords: AI vendor, controller-processor, due diligence, SaaS AI, joint controller, Art. 28.Votes: 0GitHub stars: 264
- Ai Transparency ReqsImplements AI transparency requirements under EU AI Act Arts. 13-14 and GDPR Arts. 13-14. Covers user notification of AI interaction, system capability disclosure, limitation documentation, and meaningful information about automated logic. Keywords: AI transparency, EU AI Act, GDPR notification, explainability, automated decision.Votes: 0GitHub stars: 264
- Ai Model Privacy AuditConducts privacy auditing of AI models including training data extraction testing, membership inference attacks, model inversion testing, and attribute inference assessment. Uses ML Privacy Meter and related tools to quantify privacy leakage. Keywords: model audit, membership inference, privacy meter, model inversion, training data extraction.Votes: 0GitHub stars: 264
- Ai Federated LearningImplements federated learning architecture patterns for GDPR compliance. Covers secure aggregation protocols, differential privacy integration, communication protocols, and privacy-by-design distributed ML training. Keywords: federated learning, distributed training, secure aggregation, differential privacy, privacy-preserving ML.Votes: 0GitHub stars: 264
- Ai Deployment ChecklistPre-deployment privacy compliance checklist for AI/ML systems covering DPIA completion, lawful basis verification, transparency notices, human oversight mechanisms, bias testing, and post-deployment monitoring setup. Keywords: AI deployment, privacy checklist, go-live, model deployment, compliance gate.Votes: 0GitHub stars: 264
- Ai Data Subject RightsImplements data subject rights mechanisms for AI systems including right to explanation of AI decisions, contestation procedures, human review, model output correction, and training data access. Covers GDPR Arts. 15-22 and AI Act Art. 86. Keywords: data subject rights, AI explanation, contestation, human review, training data access, model correction.Votes: 0GitHub stars: 264
- Ai Bias Special CategoryAssesses AI bias risks for GDPR Art. 9 special category data and AI Act Art. 10 data governance. Covers fairness metrics, bias detection methods, mitigation strategies, and documentation requirements for protected characteristics. Keywords: AI bias, special category, fairness metrics, discrimination, Art. 9, Art. 10.Votes: 0GitHub stars: 264
- Ai Automated DecisionsImplements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.Votes: 0GitHub stars: 264
- Ai Act High Risk DocsPreparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.Votes: 0GitHub stars: 264
- Scoring Optimizer보조금/지원사업 신청에서 평가 배점을 분석하고 최적화 전략을 수립하는 전문 스킬. compliance-checker와 plan-writer 에이전트가 평가 기준별 배점을 최적화하고 탈락 위험을 사전 차단할 때 활용한다. '배점 최적화', '평가 기준 분석', '가점 전략', '탈락 방지', '심사 대비' 등의 맥락에서 자동 적용한다. 단, 실제 심사위원 접촉이나 심사 결과 조회는 이 스킬의 범위가 아니다.Votes: 0GitHub stars: 1,256
- Threat ModelingSTRIDE, DREAD, Attack Tree etc. threat model methodologyand threat identification·evaluation· strategy count guide. 'STRIDE', 'DREAD', 'threat model', 'threat modeling', 'attack tree', 'attack surface', 'threat identification', 'security ' etc. system threat analysis this for. security-consultantand pentest-reporterof threat analysis -ize. , actual penetration test executionthis CVE this of scope .Votes: 0GitHub stars: 1,256
- Security Auditsecurity auditof vulnerability , code security analysis, penetration test , improvement inthisbefore teamthis to countlower security audit pipeline. 'security audit', 'vulnerability ', 'security ', 'code security analysis', 'penetration test report', 'security vulnerability ', 'OWASP ', 'queue ', 'security improvement ', 'infrastructure security ' etc. security audit beforein this for. code analysisonly necessarylower improvement only necessary inalso supported. , actual network penetrat...Votes: 0GitHub stars: 1,256
- Owasp Testing GuideOWASP Top 10 security test methodology, vulnerabilityper attack , detection , modification guide. 'OWASP', 'Top 10', 'XSS', 'SQL Injection', 'CSRF', 'SSRF', 'Injection', 'security test methodology', 'vulnerability test' etc. this security test this for. code-analystand pentest-reporterof security analysis -ize. , actual penetration test executionthis network this of scope .Votes: 0GitHub stars: 1,256
- Cve AnalysisCVE(Common Vulnerabilities and Exposures) analysis methodology, dependency vulnerability also for, CVSS count , vulnerability priority decision guide. 'CVE', 'vulnerability analysis', 'dependency vulnerability', 'CVSS', 'npm audit', 'Snyk', 'Trivy', 'CVE database', 'vulnerability priority' etc. CVE vulnerability analysis this for. vulnerability-scannerof -ize. , actual penetration test executionthis code modification this of scope .Votes: 0GitHub stars: 1,256
- Vulnerability PatternsCode vulnerability pattern database. An extension skill for security-analyst that provides language-specific (Python/JS/Java/Go) vulnerable code patterns, CWE classification, safe alternative code, and severity assessment criteria. Use when performing security reviews involving 'vulnerability patterns', 'CWE', 'SQL Injection', 'XSS', 'security vulnerabilities', 'secure coding', 'vulnerable code', etc. Note: penetration testing execution and WAF configuration are outside the scope of this skill.Votes: 0GitHub stars: 1,256
- Api Error DesignAPI error design patterns. An extension skill for doc-writer/mock-tester that provides error code systems, error response structures, client-friendly error messages, error catalog construction, and retry/fallback strategies. Use when designing API error handling systems involving 'API error design', 'error codes', 'error responses', 'error catalogs', 'error messages', 'retry strategies', etc. Note: actual error handling code implementation is outside the scope of this skill.Votes: 0GitHub stars: 1,256
- Api Security ChecklistWeb app API security checklist. Provides OWASP Top 10-based vulnerability checks, authentication/authorization patterns, input validation, Rate Limiting, CORS, CSRF, and SQL Injection defense as a backend-dev extension skill. Use for requests like 'API security', 'OWASP', 'auth implementation', 'SQL Injection', 'XSS defense', 'CORS configuration', 'security checklist', and other backend security design tasks. However, penetration testing or WAF configuration is outside this skill's scope.Votes: 0GitHub stars: 1,256
- Sast XxeDetect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to find XXE or XML injection bugs.Votes: 0GitHub stars: 1,358
- Sast SstiDetect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.Votes: 0GitHub stars: 1,358
- Sast MissingauthDetect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/...Votes: 0GitHub stars: 1,358
- Sast JwtDetect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT...Votes: 0GitHub stars: 1,358