Loading...
Loading...
Found 4,084 Skills
Verify earlier findings and identify what still needs attention.
This skill should be used when the user asks about "electrobun RPC", "defineElectrobunRPC", "Electroview.defineRPC", "ElectrobunRPCSchema", bun-to-renderer communication, or renderer-to-bun communication. Activates automatically when RPC code is present.
Review code changes and return numbered findings with priority and the exact location of each issue. Use when the user asks for a code review or shows a diff, a pull request, or a file to check. Do NOT rewrite whole files or apply fixes the user has not approved — suggest the fix, wait for approval, and never review code you have not actually read.
Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector, or estimating severity.
HTTP Parameter Pollution (HPP) and JSON key duplication auditing across Express, Django, Flask, Spring, ASP.NET, and PHP backends, analyzing how front-end validators and back-end handlers resolve duplicate parameters. Use when auditing multi-layer validation and API gateways.
Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server, or programming language. - - - - a Burp Suite extension for sending large numbers of HTTP requests and...
CI/CD secret hygiene and architecture audit covering replacement of long-lived cloud keys with OIDC workload identity federation, environment approval gates, log redaction, and pre-commit secret scanning.
Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is "external red team for an enterprise client" (not H1/Bugcrowd/Intigriti), when generating the final report, when the client has specified a custom report format, or when packaging findings into DOCX/PDF.
Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.
A technique where specific prompts or cues are inserted into the input data to guide the output of a machine learning model, specifically in the field of natural language processing (NLP). Simple list of tools that can be targeted by 'Prompt Injection'. They can also be used to generate interesting prompts. List of 'payloads' prompts Prompt Injections Everywhere LLM vulnerability scanner Tools to...
Windows binary and OS mitigation verification covering High-Entropy ASLR, DEP/NX, Control Flow Guard (CFG), eXtended Flow Guard (XFG), Intel CET Hardware Shadow Stacks, ACG, and Hypervisor-Protected Code Integrity (HVCI).
Linux local privilege boundary auditing covering SUID/SGID binaries, POSIX file capabilities (`getcap`), `sudoers` NOPASSWD/wildcard rules, writable systemd unit paths, cron job scripts, and kernel sysctl hardening.