All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,788
- 1,325
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,033–19,056 of 31,788 skills
- Analyzing Uefi Bootkit Persistence'Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System PartitionVotes: 0GitHub stars: 11
- Analyzing Sbom For Supply Chain Vulnerabilities'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilitiesVotes: 0GitHub stars: 11
- Analyzing Ransomware Leak Site IntelligenceMonitor and analyze ransomware group data leak sites (DLS) to track victim postings, extract threat intelligenceVotes: 0GitHub stars: 11
- Analyzing Pdf Malware With Pdfid'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode,Votes: 0GitHub stars: 11
- Analyzing Ios App Security With ObjectionRuntime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.Votes: 0GitHub stars: 11
- Analyzing Docker Container ForensicsInvestigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts toVotes: 0GitHub stars: 11
- Analyzing Bootkit And Rootkit Samples'Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot RecordVotes: 0GitHub stars: 11
- Vulnerability TriagePrioritizes vulnerability findings from scanners, pentest reports, and bug bounty submissions by real-world exploitability rather than raw CVSS, assigning internal severity tiers with fix SLAs. Use when someone asks "which of these CVEs do we fix first", "triage this scanner report", "is this CVSS 9.8 actually critical for us", or is facing a wall of security findings and needs an actionable queue. Do NOT use for enumerating threats in a design that has not shipped - use threat-model-stride i...Votes: 0GitHub stars: 18
- Threat Model StrideApplies STRIDE threat modeling to a feature or system design and produces a prioritized threat table with concrete mitigations ranked by exploitability and impact. Use when someone asks "threat model this feature", "what could go wrong with this design", "is this integration safe to build", or is reviewing auth flows, new data stores, webhook receivers, file uploads, or external integrations before the code is written. Do NOT use for prioritizing scanner or pentest findings on already-shipped...Votes: 0GitHub stars: 18
- Supabase ExpertBuilds secure Supabase apps - Row Level Security policies as the authorization layer, schema design against auth.users, Edge Functions for service-role work, realtime subscriptions, and versioned migrations. Use when someone asks "set up RLS for my tables", "is my Supabase app secure", "anyone can read my table with the anon key", "when do I need an Edge Function", or "why is my realtime subscription not receiving rows". Do NOT use for general Postgres schema design without Supabase - use dat...Votes: 0GitHub stars: 18
- Soc2 Evidence HelperMaps engineering controls to SOC 2 Trust Service Criteria, builds a continuous evidence-collection plan with cadences per control family, and produces the control-to-evidence table auditors work from. Use when someone asks "what evidence do we need for SOC 2", "map our controls to the Trust Service Criteria", "how do we prepare for Type II fieldwork", "the auditor asked for access reviews", or is closing findings or standing up a compliance program. Do NOT use for building an incident postmor...Votes: 0GitHub stars: 18
- Secure Code ReviewReviews code for the security flaw classes that cause the most breaches - broken authorization and IDOR, injection, SSRF, mass assignment, and unsafe deserialization - and returns a short, focused findings list with concrete fixes. Use when someone asks "review this code for security issues", "is this endpoint safe", "check this PR for vulnerabilities", or is shipping auth logic, new API endpoints, file handling, or anything that touches untrusted input. Do NOT use for general code quality, s...Votes: 0GitHub stars: 18
- Code Review ChecklistRun a systematic multi-pass code review - correctness, design, security, performance, tests - and report findings ordered by severity with concrete, respectful suggestions. Use when someone asks "review this PR", "review this diff", "what's wrong with this change", or wants a pre-merge quality gate on a branch. Do NOT use for a security-only deep audit of a change - use secure-code-review instead - or for writing the ticket or tracking artifact that describes the change - use jira-ticket-writ...Votes: 0GitHub stars: 18
- Dependency Risk AuditAudits third-party dependencies for exploitable CVEs, abandonment, license exposure, and supply-chain hygiene, and delivers a ranked findings report with a remediation order. Use when someone asks "is this package safe to add", "audit our dependencies", "npm audit is screaming, what actually matters", "can we use this GPL library", or is preparing a security review or vendor questionnaire. Do NOT use for triaging vulnerabilities in first-party code or a full CVE queue - use vulnerability-tria...Votes: 0GitHub stars: 2
- Wireless Network AuditAudit wireless networks (WiFi, BLE, Zigbee) for security vulnerabilities using aircrack-ng, bettercap, hcxtools, and bluetooth utilities. For authorized penetration testing and security assessments only.Votes: 0GitHub stars: 61
- Vulnerability ValidationValidate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.Votes: 0GitHub stars: 61
- Vertex AiGoogle Vertex AI via gcloud OAuth2. Call Gemini, Imagen, embeddings, and Model Garden models from the CLI. Use when users need generative AI, image generation, embeddings, or model inference.Votes: 0GitHub stars: 61
- Vermillion HunterOverviewVotes: 0GitHub stars: 61
- Variant AnalysisFind similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.Votes: 0GitHub stars: 61
- Utoronto OutlookHeadless University of Toronto Outlook email access via IMAP/SMTP with OAuth2. Uses Thunderbird's pre-authorized client ID to bypass admin consent requirements (AADSTS65002). Device code flow for initial auth, macOS Keychain for token cache.Votes: 0GitHub stars: 61
- Ton Vulnerability ScannerScans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. (project, gitignored)Votes: 0GitHub stars: 61
- Token Integration AnalyzerComprehensive token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Context-aware for both token implementations and token integrations. (project, gitignored)Votes: 0GitHub stars: 61
- Tizen Security ComplianceMaps security requirements to implementation. Coordinates compliance against FIPS 140-3, OCF, CommonCriteria, and Tizen specification.Votes: 0GitHub stars: 61
- Tizen Cve ScannerScans for known Tizen CVEs in app dependencies and kernel. Checks OpenCVE database and Samsung security updates.Votes: 0GitHub stars: 61