Menu
SkillsMP has collected 49 skills from ersinkoc/security-check. Open a skill to review its source and details.
Showing 40 of 49 collected skills.
Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when…
C#/.NET-specific security deep scan
Go-specific security deep scan
Java/Kotlin-specific security deep scan
PHP-specific security deep scan
Python-specific security deep scan
Rust-specific security deep scan
TypeScript/JavaScript-specific security deep scan
REST, GraphQL, and gRPC API security audit — authentication, authorization, data exposure, and configuration
Authentication flaw detection — weak passwords, broken auth, credential stuffing, and bypass vectors
Authorization flaw detection — IDOR, broken access control, horizontal and vertical privilege issues
Business logic flaw detection — price manipulation, workflow bypass, race conditions, and abuse vectors
CI/CD pipeline security — GitHub Actions injection, secret exposure, untrusted actions, and artifact poisoning
Clickjacking and UI redressing detection — missing frame protection headers and CSP frame-ancestors
OS Command Injection detection in shell execution, subprocess calls, and process spawning
CORS misconfiguration detection — wildcard origin, reflected origin, null origin, and credential leaks
Cryptography misuse detection — weak algorithms, ECB mode, static IVs, weak PRNG, and key management flaws
Cross-Site Request Forgery detection — missing tokens, SameSite misconfiguration, and CORS-CSRF interaction
Sensitive data exposure detection — PII leaks, verbose errors, debug mode, and information disclosure
Supply chain and dependency security analysis across all package ecosystems
Insecure deserialization detection across all serialization formats and languages
Incremental security scan for changed files only — optimized for PR and commit-level reviews
Docker-specific security checks — image hardening, secrets in layers, compose security, and runtime configuration
Insecure file upload detection — unrestricted types, MIME mismatch, polyglot files, and webshell upload
GraphQL injection, introspection abuse, query complexity attacks, and authorization bypass detection
HTTP Header Injection and Response Splitting detection via CRLF injection in headers
Infrastructure-as-Code security scanning — Dockerfile, Kubernetes, Terraform, and GitHub Actions misconfigurations
JWT implementation flaw detection — algorithm confusion, weak secrets, missing validation, and storage issues
LDAP Injection detection in search filters, DN construction, and bind operations
Mass assignment and over-posting detection — unfiltered request body binding to data models
NoSQL Injection detection for MongoDB, Redis, CouchDB, and Elasticsearch
Open redirect detection — unvalidated redirect URLs, protocol-relative bypasses, and URI scheme abuse
Master orchestration skill that coordinates the entire 4-phase security scanning pipeline
Path traversal and directory traversal detection — LFI, RFI, zip slip, and symlink attacks
Privilege escalation vector detection — role manipulation, admin bypass, and RBAC circumvention
Race condition and TOCTOU detection — database races, file system races, double-spend, and atomicity failures
Missing rate limiting and application-level DoS vector detection — ReDoS, query complexity, resource exhaustion
Remote Code Execution detection via eval, exec, dynamic code loading, and code injection vectors
Codebase discovery and architecture mapping for security analysis
Final consolidated security assessment report generator with CVSS severity and remediation roadmap