All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,608
- 1,317
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,945–19,968 of 31,608 skills
- Wp Svg Icon ApiRegister, discover, render, and audit SVG icons with the public WordPress 7.1 Icons API. Covers wp_register_icon_collection, wp_register_icon, wp_get_icon, unregistering icons and collections, collection/name rules, inline content versus file_path, core SVG sanitization limits, accessible labels versus decorative output, sizing/classes, lazy file reads, authenticated REST icon and collection routes, duplicate handling, and compatibility fallbacks. Use when a plugin or theme needs reusable SVG...Votes: 0GitHub stars: 24
- Wp Speculative LoadingConfigure or audit WordPress speculative loading and Speculation Rules: prefetch/prerender mode, eagerness, safe URL exclusions, custom rules, per-link opt-out, cache/session correctness, and WordPress 7.1 host default constants. Use when a plugin owns frontend URLs, carts, logout/destructive links, personalized pages, navigation performance, or emits speculationrules.Votes: 0GitHub stars: 24
- Wp File Upload SecurityImplement or audit secure WordPress file uploads and sideloadsVotes: 0GitHub stars: 24
- Wp Dependency Security AuditAudit third-party PHP and JavaScript dependencies bundled with aVotes: 0GitHub stars: 24
- Wc Downloadable ProductsImplement, extend, or audit WooCommerce downloadable products and customer download access. Covers WC_Product_Download, stable download IDs, product CRUD, approved directories, the customer-download permission table and WC_Customer_Download CRUD, order-based grants and safe regeneration, limits and expiry, My Account and REST reads, bearer download URLs, download methods, logging, partial requests, and protected file storage. Use for _downloadable_files, wc_downloadable_product_permissions(),...Votes: 0GitHub stars: 24
- Wp Redis Object CacheConfigure, audit, troubleshoot, and extend the Redis Object Cache plugin (`redis-cache`) for WordPress persistent object caching. Covers the `wp-content/object-cache.php` drop-in, `wp redis status|enable|disable|update-dropin`, `WP_REDIS_*` constants, Predis/PhpRedis/Relay client selection, cache groups, selective flush, metrics, Query Monitor integration, and correct plugin code that uses `wp_cache_*` with Redis Object Cache.Votes: 0GitHub stars: 24
- Fluentform Submission LifecycleImplements and audits Fluent Forms server-side submission behavior from parsed field data through sanitization, validation, persistence, entry details, notifications, integrations, and confirmation. Selects the correct fluentform/input_data_*, fluentform/validation_errors, fluentform/insert_response_data, fluentform/submission_inserted, and fluentform/submission_confirmation hook and explains their timing. Use when adding cross-field validation, normalizing submitted values, reacting to an en...Votes: 0GitHub stars: 24
- Fluentform Feed IntegrationBuilds and audits configurable third-party Fluent Forms feed integrations with IntegrationManagerController. Covers addon/global settings, per-form feed UI, field mapping, conditional execution, smart-code parsing, synchronous versus asynchronous dispatch, ff_scheduled_actions, Action Scheduler, result logging, credential handling, retries, and idempotency. Use when adding a CRM, webhook, messaging, storage, or external API connector; extending fluentform/get_available_form_integrations; hand...Votes: 0GitHub stars: 24
- Fluentcart Licensing ProImplements and audits FluentCart Pro product licensing, license generation, activation limits, site activation/deactivation, customer/admin access, subscription validity, refunds, update checks, package delivery, and legacy EDD-compatible clients. Use when working with the Pro Licensing module, LicenseManager, LicenseHelper, fct_licenses, fct_license_activations, fluent_cart_action_* license endpoints, license lifecycle hooks, protected plugin downloads, local/staging activations, or license ...Votes: 0GitHub stars: 24
- Fluentcart Integrations JobsBuilds and audits FluentCart product/global integration feeds, CRM/LMS/ webhook automations, BaseIntegrationManager providers, lifecycle-triggered provisioning, fct_scheduled_actions, Action Scheduler dispatch, retries, replay protection, logs, and maintenance jobs. Use when registering fluent_cart/integration/order_integrations, integration/run/* handlers, asynchronous order actions, background notifications, external API calls, order_paid_done provisioning, revoke events, scheduled cleanup,...Votes: 0GitHub stars: 24
- Remotion Best PracticesBest practices for Remotion - Video creation in ReactVotes: 0GitHub stars: 1,132
- Xss Browser ConfirmTurn a suspected Cross-Site Scripting reflection or DOM sink into proof of JavaScript execution by firing a uniquely-tagged dialog in a real headless browser via the browser_probe tool — not by string-matching the response. Covers reflected, stored, and DOM-based XSS, context-aware payload crafting (HTML body, attribute, JS string, URL/href, DOM sink), light WAF/encoding evasion when a payload reflects but doesn't execute, and persisting a finding sized by real impact. Use when a parameter's ...Votes: 0GitHub stars: 1,132
- Write JsextReference for writing custom vigolium JavaScript extensions. Use when you need to author a one-off scanner module — passive (reads existing HTTP records) or active (sends new requests) — and run it via the run_extension tool. Covers the module shape, the vigolium.* API surface, and the common pitfalls.Votes: 0GitHub stars: 1,132
- Triage FindingDeduplicate, prioritize, and sanity-check a list of raw scanner findings. Use after a dynamic scan completes or when the user asks to review a findings dump. Produces a triaged list with severity adjustments, false-positive calls, and exploitability notes.Votes: 0GitHub stars: 1,132
- Ssrf To Internal Service BreachEscalate a suspected or confirmed Server-Side Request Forgery into proof of internal-service access — cloud metadata, internal-only APIs, database greetings, or redacted-but-fetchable HTTP. Use when a parameter takes a URL (image proxy, webhook, fetcher, URL preview, PDF render) and the server reaches outbound on your behalf, or when an audit finding tags CWE-918. Confirms reachability via OAST, then walks targeted internal endpoints, ending with a finding sized by the highest-value asset rea...Votes: 0GitHub stars: 1,132
- Sqli To Data ExfilEscalate a suspected or confirmed SQL injection into proof-level data exfiltration. Use when you spot an SQL error in a response, a record from a prior scan flagged a SQLi pattern, or boolean/time differentials indicate the payload reaches the query parser. Walks from probe → confirm → enumerate → exfil with payload-class-aware techniques (in-band, blind boolean, blind time, blind OAST) and ends by persisting a concrete finding with the leaked sample.Votes: 0GitHub stars: 1,132
- Idor Blast RadiusWhen you find an Insecure Direct Object Reference (a URL/body/header parameter that lets you read or write another user's or another tenant's object), discover the ID space, prove the access is unauthorized, quantify the blast radius (how many records reachable, what data class, read vs write, same-tenant vs cross-tenant), and persist a finding sized by real impact rather than by the existence of the flaw. Use when an ID parameter (numeric, UUID, hash, slug, or an indirect ref in a header/coo...Votes: 0GitHub stars: 1,132
- Escalate Auth BypassTurn a suspected or confirmed authentication/authorization bypass into impact — admin access, session takeover, privilege escalation, or cross-tenant read. Use when you find a missing auth check on a route, a weak JWT verifier, a session cookie that's predictable or reusable across users, a privilege field client-controllable, or an audit finding tagged CWE-287/CWE-863/CWE-639. Walks from probe to admin-equivalent capability and persists a finding with the highest-impact action you reached.Votes: 0GitHub stars: 1,132
- Command Injection RceTurn suspected OS command injection (a parameter that lands in a shell or a child process) into proof of remote code execution via an OAST callback, plus one safe demonstration of follow-on impact (read a file, list users, env dump). Use when a parameter feeds an exec/spawn/system call, when payloads with $(), `` ` ``, `;`, `|`, `&&` cause response differences, or when audit flags CWE-78 / CWE-77. Never sends destructive commands.Votes: 0GitHub stars: 1,132
- Audit AuthAudit authentication and session-management code for common issues — weak JWT config, session fixation, password-handling flaws, insecure cookies, broken OAuth flows, and missing auth checks on routes. Use when the user asks to review auth code or when source-aware scanning targets login/session/token handling.Votes: 0GitHub stars: 1,132
- Nist Ai Rmf ExpertNIST AI 100-1 (AI RMF 1.0) expert. Stub-depth framework plugin that routes to the SCF crosswalk. Level up by adding framework-specific context, assessment workflow, and evidence patterns.Votes: 0GitHub stars: 430
- Aws Secrets Inspector ExpertUse when interpreting AWS Secrets Manager connector output, deciding between inspector and retrieve modes, drafting SCF-mapped controls for rotation / KMS / public-access / inactive-access findings, or troubleshooting an aws-secrets-inspector run.Votes: 0GitHub stars: 430
- Offensive Windows PrivescComprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotato, and RoguePotato; service misconfigurations including unquoted service paths, weak service DACLs, writable service binaries, and insecure service creation permissions; AlwaysInstallElevated MSI...Votes: 0GitHub stars: 10,446
- Offensive Linux PrivescComprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse via GTFOBins, Linux capabilities exploitation (cap_setuid, cap_dac_override, cap_dac_read_search), sudo misconfigurations including NOPASSWD rules and Baron Samedit (CVE-2021-3156), cron job abuse through writable scripts, PATH hijacking, and wildcard injection with tar/rsync/chown. Includes writable /etc/passwd atta...Votes: 0GitHub stars: 10,446