All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,807
- 1,326
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,585–19,608 of 31,807 skills
- Supply Chain SecurityVet dependencies before they enter the build: typosquats, dependency confusion, malicious packages, known vulnerabilities, unlocked resolution, risky install and build hooks, EOL embedded runtimes, and the authenticity and freshness of your own release channel. Use when adding or upgrading a dependency, reviewing package manifests or lockfiles, configuring package sources or internal namespaces, or publishing a package or application update.Votes: 0GitHub stars: 22
- Serverless SecurityWhat a function-as-a-service platform changes: an execution environment reused between invocations so /tmp and module globals outlive a request, an event envelope that is attacker-influenced whichever trigger delivered it, encrypted-at-rest configuration that the control-plane API still returns in cleartext, and concurrency as the boundary between an incident and a bill. Use when generating Lambda, Cloud Functions, or Azure Functions code, serverless.yml or SAM templates, or wiring API Gatewa...Votes: 0GitHub stars: 22
- Secret DetectionKeeping credentials out of source, and what to do once one is in: rotate before removing, because deleting the line does not un-leak it. Covers where a secret may live, safe .env templates, why a client-reachable config value is public, and running a scanner rather than eyeballing for patterns. Use when writing code that reads a credential, creating config or .env templates, before committing, or after discovering a secret in a repository.Votes: 0GitHub stars: 22
- Saas SecurityWiring your application to a third-party SaaS platform: verifying an inbound webhook against the vendor's own scheme rather than a generalized one, why a valid signature identifies the sender and not the user in the payload, replay windows, one credential per integration and per environment, least-privilege scopes, and treating a bulk export as a data boundary. Use when writing a webhook receiver, an OAuth integration, a SCIM endpoint, or any code that authenticates to or from a SaaS vendor.Votes: 0GitHub stars: 22
- Ml SecurityThe model and data artifacts: checkpoint formats that execute code on load, provenance for a model you did not train, training-data poisoning and the ingestion controls that bound it, PII that survives into weights, and notebooks that commit their own output. Use when loading a model from disk, a Hub, or object storage, ingesting user content for training or fine-tuning, or writing training, evaluation, or notebook code.Votes: 0GitHub stars: 22
- Logging SecurityKeep secrets and personal data out of logs at the call site rather than relying on redaction, neutralize log and field injection, record audit events that survive, and treat log read access as data access. Use when generating logger calls or structured-logging schemas, wiring log shippers, sinks, retention, and access controls, or specifying audit-logging requirements.Votes: 0GitHub stars: 22
- Llm App SecuritySecuring a feature that calls an LLM: prompt injection as an unsolved input problem, bounding what model output is allowed to reach, tool authorization against the human rather than the model, approval gates on consequential actions, RAG context provenance, system-prompt leakage, and cost limits. Use when sending prompts to an LLM API, building a RAG pipeline, giving a model tools, rendering or executing model output, or exposing an LLM-backed endpoint.Votes: 0GitHub stars: 22
- Iac SecurityTerraform, CloudFormation, and Pulumi hardening: state as a secret store, pinned providers and modules, encryption and network defaults, drift, and the privilege of the pipeline that applies the plan. Use when generating infrastructure code, reviewing IaC changes in a pull request, configuring a state backend, or setting up a new cloud account or workspace.Votes: 0GitHub stars: 22
- Frontend SecurityBrowser-side hardening: XSS and safe text binding, per-sink URL policy, DOM clobbering, nonce-based CSP, Trusted Types, subresource integrity, iframe capability minimization, postMessage validation, and where client state may live. Use when generating HTML, JSX, Vue, or Svelte templates, setting response headers in a web app, embedding third-party scripts or frames, or storing anything client-side.Votes: 0GitHub stars: 22
- File Upload SecurityAccept, store, process, and serve user uploads safely: type-appropriate content validation, decompression limits, generated storage keys, quarantine before publication, isolated media processing, and scoped direct-to-storage credentials. Use when generating a file-upload endpoint, wiring presigned or SAS uploads to S3, GCS, or Azure Blob, processing user-supplied images or documents, or serving user-generated content.Votes: 0GitHub stars: 22
- Error Handling SecurityDecide what an error tells the client and what stays server-side: no stack traces, SQL, or paths in responses, no silent suppression, and no distinction between outcomes that would reveal protected state. Use when generating HTTP, GraphQL, or RPC error handlers, exception, panic, or rescue blocks, or configuring production error pages.Votes: 0GitHub stars: 22
- Electron SecurityHarden Electron: renderer trust boundary (nodeIntegration, contextIsolation, sandbox), build-time fuses, contextBridge and IPC allowlists, shell.openExternal, navigation guards, deep-link auth, safeStorage. Use when generating main-process code, a preload script, or custom-protocol handlers, when packaging a release, or when storing tokens in an Electron app.Votes: 0GitHub stars: 22
- Dynamic VerificationConfirm or refute a vulnerability candidate against a live target with a deterministic probe, respecting authorization and scope. Use when a SAST or LLM review flags a possible injection or SSRF, when triaging a finding before filing a bug or shipping a fix, or when a verification result turns out wrong.Votes: 0GitHub stars: 22
- Database SecurityPrevent SQL and NoSQL injection, unsafe ORM and raw-query use, over-privileged database identities, weak tenant isolation, and unauthenticated database transport. Use when generating SQL or raw query strings, NoSQL filters, ORM models or queries, database migration files, or connection strings.Votes: 0GitHub stars: 22
- Crypto MisuseBlock weak ciphers, predictable RNG, undersized keys, fast-hash password storage, nonce reuse, and non-constant-time comparison. Use when generating code that hashes, encrypts, or signs, code that compares secrets, MACs, or tokens, or config for key sizes and randomness.Votes: 0GitHub stars: 22
- Cors SecurityStrict CORS: no wildcard with credentials, exact-match origin allowlists, sane preflight cache, minimal exposed headers. Use when generating CORS middleware or framework config, setting CORS headers in API Gateway, CloudFront, or Nginx, or reviewing a cross-origin browser-facing endpoint.Votes: 0GitHub stars: 22
- Container SecurityHardening for Dockerfiles, OCI images, Kubernetes manifests, and Helm charts. Use when generating a Dockerfile or image build, writing Kubernetes, Helm, or Kustomize manifests, or reviewing container changes in a pull request.Votes: 0GitHub stars: 22
- Auth SecurityAuthentication and authorization: JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, MFA, and object-level / function-level authorization (BOLA, IDOR) — confirming the caller may access the specific resource they asked for. Use when generating login, signup, or password-reset flows, issuing or verifying JWTs, writing OAuth or OIDC code, wiring session cookies or MFA, or writing any endpoint that reads or writes a resource by id.Votes: 0GitHub stars: 22
- Api SecurityOWASP API Top 10 for HTTP, GraphQL, and gRPC endpoints: input validation, route rate limiting, mass assignment, response caching, and gateway-versus-service control placement. Use when generating or reviewing HTTP handlers, GraphQL resolvers, gRPC service methods, or any API endpoint change.Votes: 0GitHub stars: 22
- QuickstartUse this skill when the user wants to scan a Laravel project for security vulnerabilities, misconfigurations, exposed secrets, or perform security audits.Votes: 0GitHub stars: 53
- QuickstartUse this skill when the user wants to explore vulnerability data (CVEs) with advanced filtering.Votes: 0GitHub stars: 53
- QuickstartUse this skill when the user wants to find vulnerabilities, misconfigurations, secrets, sbom in containers and code.Votes: 0GitHub stars: 53
- QuickstartUse this skill when the user wants to scan for security vulnerabilities, secrets, CI/CD misconfigs, or agentic AI risks in their codebase.Votes: 0GitHub stars: 53
- Quickstartripsecrets is a command-line tool designed to scan source code for accidentally committed secrets and API keys. It's 95x faster than comparable tools and uses intelligent pattern detection to find sensitive data before it reaches your repository.Votes: 0GitHub stars: 53