All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,697
- 1,321
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 21,145–21,168 of 31,697 skills
- Cloud AssessmentMulti-cloud READ-ONLY security assessment methodology for AWS, Azure, and GCP using CIS benchmark-aligned checksVotes: 0GitHub stars: 3,518
- Cicd AttacksCI/CD pipeline attacks for secret extraction, pipeline injection, and supply chain compromise via GitHub/Jenkins/GitLabVotes: 0GitHub stars: 3,518
- Ci AssessmentREAD-ONLY CI/CD pipeline security assessment for GitHub Actions, dependency security, and software supply chainVotes: 0GitHub stars: 3,518
- Bun File IoUse this when you are working on file operations like reading, writing, scanning, or deleting files. It summarizes the preferred file APIs and patterns used in this repo. It also notes when to use filesystem helpers for directories.Votes: 0GitHub stars: 3,518
- Azure PostexploitAzure/Entra ID post-exploitation — 154 programs for tenant compromise, CIS compliance, identity attacks, data exfiltration, and M365 abuseVotes: 0GitHub stars: 3,518
- Aws PostexploitAWS post-exploitation — 92 programs for full kill chain from recon to cleanup via AWS CLIVotes: 0GitHub stars: 3,518
- Attack XxeXML External Entity injection — file read, SSRF, data exfiltration via out-of-band XML parsingVotes: 0GitHub stars: 3,518
- Attack WebsocketWebSocket security testing — CSWSH, message injection, auth bypass, origin validationVotes: 0GitHub stars: 3,518
- Attack Subdomain TakeoverSubdomain takeover — CNAME detection, cloud service fingerprinting, dangling DNS exploitationVotes: 0GitHub stars: 3,518
- Attack SstiServer-Side Template Injection — detection, engine fingerprinting, and exploitation across 7 template enginesVotes: 0GitHub stars: 3,518
- Attack SsrfServer-Side Request Forgery — internal network access, cloud metadata theft, filter bypass techniquesVotes: 0GitHub stars: 3,518
- Attack Request SmugglingHTTP request smuggling — CL.TE, TE.CL, TE.TE desync attacks for cache poisoning and auth bypassVotes: 0GitHub stars: 3,518
- Attack Rate Limit BypassRate limit bypass testing — XFF rotation, case variation, method switching, header manipulationVotes: 0GitHub stars: 3,518
- Attack Race ConditionRace condition / TOCTOU testing — concurrent requests to exploit time-of-check-to-time-of-use flawsVotes: 0GitHub stars: 3,518
- Attack Prototype PollutionJavaScript prototype pollution — __proto__ injection, constructor.prototype, gadget chain exploitationVotes: 0GitHub stars: 3,518
- Attack Open RedirectOpen redirect exploitation — URL parameter manipulation, OAuth token theft, phishing chainsVotes: 0GitHub stars: 3,518
- Attack JwtJWT token attacks — alg:none bypass, key confusion, claim tampering, signature strippingVotes: 0GitHub stars: 3,518
- Attack Idor AutomationIDOR automated testing — cross-account access, horizontal/vertical privilege escalation, mass data exposureVotes: 0GitHub stars: 3,518
- Attack Host HeaderHost header injection — password reset poisoning, cache poisoning, routing bypass, SSRF via HostVotes: 0GitHub stars: 3,518
- Attack GraphqlGraphQL vulnerability testing — introspection exposure, complexity DoS, batch abuse, mutation auth bypassVotes: 0GitHub stars: 3,518
- Attack CorsCORS misconfiguration testing — origin reflection, wildcard bypass, null origin, credential leakageVotes: 0GitHub stars: 3,518
- Attack Cache PoisonWeb cache poisoning — unkeyed header/parameter injection to serve malicious content to all usersVotes: 0GitHub stars: 3,518
- Ad SecurityActive Directory security testing and attack techniquesVotes: 0GitHub stars: 3,518
- Wstg Sess 11Testing for Concurrent SessionsVotes: 0GitHub stars: 3,518