igbuend/grimbard - Page 3

verbose-error-messages-anti-pattern

Security anti-pattern for verbose error messages (CWE-209). Use when generating or reviewing code that handles errors, exceptions, or generates user-facing error responses. Detects stack trace exposure and detailed error information leakage to users.

Langue du texte source : anglais

weak-encryption-anti-pattern

Security anti-pattern for weak encryption (CWE-326, CWE-327). Use when generating or reviewing code that encrypts data, handles encryption keys, or uses cryptographic modes. Detects DES, ECB mode, static IVs, and custom crypto implementations.

Langue du texte source : anglais

weak-password-hashing-anti-pattern

Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing password hashing entirely. Recommends bcrypt, Argon2,…

Langue du texte source : anglais

xpath-injection-anti-pattern

Security anti-pattern for XPath injection vulnerabilities (CWE-643). Use when generating or reviewing code that queries XML documents, constructs XPath expressions, or handles user input in XML operations. Detects unescaped quotes and special characters in…

Langue du texte source : anglais

xss-anti-pattern

Security anti-pattern for Cross-Site Scripting vulnerabilities (CWE-79). Use when generating or reviewing code that renders HTML, handles user input in web pages, uses innerHTML/document.write, or builds dynamic web content. Covers Reflected, Stored, and…

Langue du texte source : anglais

attack-surface-xss

Reconnaissance skill for XSS attack surface — analyzes headers, frameworks, JS libraries, and DOM patterns at a URL to map what makes XSS possible or harder. For ethical hackers preparing for XSS testing.

Langue du texte source : anglais

codebase-discovery

Generate security-focused DISCOVERY.md for code review and threat modeling. Use when assessing unfamiliar codebases.

Langue du texte source : anglais

ethical-hacking-ethics

Legal and ethical guidelines for bug bounties, pentesting, and security research. Use when conducting authorized security testing.

Langue du texte source : anglais

sarif-issue-reporter

Analyze SARIF files and generate security reports with CVSS scoring, exploitation scenarios, and remediation guidance. Use when reviewing static analysis results.

Langue du texte source : anglais