Menú
Skills en este repositorio
SkillsMP ha recopilado 130 skills de UnboundCompute/security-agent-skills. Abre una skill para revisar su origen y sus detalles.
UnboundCompute/security-agent-skillsMostrando 40 de 130 skills recopiladas.
Hunt expression-language injection where untrusted input reaches a server-side expression evaluator: Spring Expression Language, OGNL, MVEL, JEXL, a Jakarta or JSP EL context, or a rules engine that evaluates strings. Covers request data flowing into an…
Idioma del texto original: inglés
Hunt Java deserialization that turns an untrusted byte stream into code execution: attacker-controlled data reaching readObject, an ObjectInputStream, or a framework endpoint that deserializes, with a gadget on the classpath whose readObject or finalizer…
Idioma del texto original: inglés
Hunt LDAP injection and bind-trust flaws where untrusted input reaches a directory query or an authentication bind: a request value spliced into a search filter or a distinguished name without escaping, letting the caller alter the filter logic or the search…
Idioma del texto original: inglés
Hunt NoSQL injection where untrusted input becomes query structure rather than a bound value: a request body whose keys turn into query operators, a value that arrives as an object instead of a scalar, or input reaching a server-side JavaScript evaluation…
Idioma del texto original: inglés
Hunt PHP object injection where untrusted input reaches unserialize or a framework unserializer and a reachable class carries a magic method that fires during or after reconstruction. Covers native unserialize on request data, cookies, or cache entries, phar…
Idioma del texto original: inglés
Hunt Python deserialization that executes attacker code: untrusted input reaching pickle.loads, an unsafe YAML load, marshal, jsonpickle, dill, or a numpy or pandas loader that unpickles, where the format supports arbitrary object construction through…
Idioma del texto original: inglés
Hunt injection into search and analytics engines such as Elasticsearch, OpenSearch, and Solr where untrusted input reaches a query DSL body, a query-string or Lucene query, a script field, or a stored scripting expression. Covers request data that becomes…
Idioma del texto original: inglés
Hunt server-side prototype pollution in JavaScript and TypeScript backends where untrusted input sets a __proto__, constructor, or prototype key through a recursive merge, a deep clone, a path-based set, or a query or body parser, polluting Object.prototype…
Idioma del texto original: inglés
Audit a browser extension (Manifest V3) for a trust boundary another web page or extension can cross to reach a privileged capability, after the permission scope and the message-sender checks are resolved. Covers an externally_connectable or onMessageExternal…
Idioma del texto original: inglés
Audit an editor or IDE extension for actions it runs on untrusted workspace contents, after the workspace-trust capability and activation events are resolved. Covers a task, debug preLaunchTask, or command that auto-runs on folder open, a tool path or command…
Idioma del texto original: inglés
Audit an Electron desktop app for untrusted renderer content that reaches a Node or operating-system capability, after the webPreferences and the preload bridge surface are resolved. Covers nodeIntegration enabled with contextIsolation off, a preload that…
Idioma del texto original: inglés
Audit a file-upload and content-handling path for an attacker-supplied file whose bytes, declared type, name, or embedded content reach a sink that stores it in a served or executable location or feeds it to a parser that acts on its content, after the…
Idioma del texto original: inglés
Audit a gRPC service for a method a caller can reach without the authorization the service assumes an interceptor enforces, after the interceptor coverage and the channel credentials are resolved. Covers authorization installed on the unary interceptor while…
Idioma del texto original: inglés
Audit code that verifies a JSON Web Token for a signature or claims check that trusts token-supplied parameters, so an attacker can forge a token the server accepts, after the algorithm pinning and the key source are resolved. Covers an algorithm taken from…
Idioma del texto original: inglés
Audit a Move smart contract (Aptos or Sui) for a public entry function or a passed object or resource that acts without verifying signer authority, ownership, or capability possession, after the function visibility and the ability set are resolved. Covers a…
Idioma del texto original: inglés
Audit a WebSocket endpoint for trust established once at the handshake and never re-checked, so a cross-site page or a post-handshake message drives a privileged action, after the origin check and the credential source are resolved. Covers a missing or…
Idioma del texto original: inglés
Hunt a CI/CD pipeline for attacker-controlled repository data that reaches a privileged execution context, after the trigger and the token scope are resolved. Covers an untrusted event field (an issue or pull-request title, a branch name, a commit message)…
Idioma del texto original: inglés
Audit an Android app for components another app on the device can reach and drive, after the manifest export flags and permission gates are resolved. Covers an activity, service, broadcast receiver, or content provider exported without a permission gate, an…
Idioma del texto original: inglés
Audit container image build definitions (Dockerfile, containerfile, and the compose or run config that sets runtime flags) for an image that ships over-privileged or carrying a secret, after multi-stage discards and deploy-time overrides are accounted for.…
Idioma del texto original: inglés
Audit existing infrastructure-as-code definitions (Terraform, OpenTofu, CloudFormation, Bicep, Pulumi) for resource state that would provision an insecure resource, after variables, modules, and account defaults are resolved. Covers storage exposed to the…
Idioma del texto original: inglés
Audit Kubernetes manifests for a subject granted more than it needs or a workload that can escape its container, after the binding graph and admission policy are resolved. Covers a RoleBinding or ClusterRoleBinding to cluster-admin or a wildcard-verb role, a…
Idioma del texto original: inglés
Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain…
Idioma del texto original: inglés
Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the…
Idioma del texto original: inglés
Audit a smart contract for a privileged action any caller can reach, so an attacker invokes a function that should be restricted. Covers a state-changing or fund-moving function missing an authorization modifier, an ownership or role check that is wrong or…
Idioma del texto original: inglés
Audit client code for transport security that is disabled or defeated, so an attacker on the network path can intercept a connection the client believes is protected. Covers verification switched off (a trust-all setting, a permissive flag, an environment…
Idioma del texto original: inglés
Hunt a decentralized-finance protocol for a way to profit by moving a price or breaking an economic invariant, rather than by defeating an access check or re-entering. Covers a price read from a spot source an attacker can move within a transaction, a…
Idioma del texto original: inglés
Hunt a mobile app for a real credential shipped in the binary or written to storage another party can read, scoped strictly to mobile-specific sinks. Covers a live secret embedded in the app package or its resources, sensitive data written to…
Idioma del texto original: inglés
Hunt a smart contract for state that is mutated after an external call, so an attacker re-enters before the update lands and acts on stale state. Covers a withdrawal or transfer that sends value before zeroing the balance, a call to an attacker-controlled…
Idioma del texto original: inglés
Hunt DNS records that point at infrastructure the organization no longer controls, so an attacker can claim the target and serve content under a trusted name. Covers a CNAME or ALIAS to a decommissioned platform host that the provider lets anyone re-register,…
Idioma del texto original: inglés
Audit the code and configuration that decide cross-origin access, for trust a browser turns into a read of authenticated data. Covers a response that reflects an arbitrary request origin into the allow-origin header alongside allow-credentials, an allowlist…
Idioma del texto original: inglés
Audit the server side of the authorization-code-with-proof-key and device-authorization grants for bugs that let a stolen or guessed code become a token. Covers a token endpoint that issues without checking the proof-key verifier at all, that accepts the…
Idioma del texto original: inglés
Audit whether every data operation is scoped to the caller's tenant, so a request in one tenant cannot read or write another's data. Covers a query or object lookup with the object identifier but no tenant predicate, a tenant taken from client-controlled…
Idioma del texto original: inglés
Audit security-sensitive values for weak randomness: a non-cryptographic generator, a predictable or constant seed, a reused nonce or initialization vector, or an output too short to resist guessing, feeding a value whose only defense is unpredictability.…
Idioma del texto original: inglés
Audit updater and bootloader code for a firmware trust boundary that lets an unsigned or downgraded image be flashed or booted. Covers an update image that reaches a flash write or a boot jump with no signature check between receipt and commit, a verification…
Idioma del texto original: inglés
Audit the server side of passwordless authentication for ceremony-verification bugs that let an attacker-shaped response become an authenticated session. Covers a registration or authentication ceremony whose challenge is not bound to a server-issued…
Idioma del texto original: inglés
Audit both directions of webhook trust: an inbound handler that acts on a payload without proving it authentic, and an outbound fetch of a caller-supplied URL that reaches internal targets. Covers inbound handlers with no signature check, a signature compared…
Idioma del texto original: inglés
Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a…
Idioma del texto original: inglés
Review a content security policy as a script-injection defense and judge whether it would actually stop injected script, with the discipline that a weak policy is a real finding mainly where an injection sink it would otherwise block exists. Covers a script…
Idioma del texto original: inglés
Review whether sensitive and expensive endpoints are rate-limited and whether the limit can be bypassed, as a coverage-and-keying problem rather than a taint flow. Covers a login, credential-reset, one-time-code verify, signup, token, payment, or…
Idioma del texto original: inglés
Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change,…
Idioma del texto original: inglés