메뉴
Use this skill when the user asks for OWASP Top 10 mapping, CWE alignment, or standards-oriented reporting. The directory name stays `owasp-2025` for backward compatibility, but external reports should use official OWASP Top 10 names.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use this skill when the user is auditing a decompiled Android application — directory structure includes `jadx_out/` / `apktool_out/`, files end in `.smali` / are jadx-renamed to `defpackage/*.java`, or the conversation mentions an APK / xAPK / `com.example.*` package. Covers the high-signal vulnerability classes vuln-scout detects in decompiled APKs and the conventions for running the unified mobile-audit workflow.
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.
Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen, Google Pay, Apple Pay, FirstData-style iframe encryptors). The skill catalogues the high-signal attack patterns vuln-scout detects in mobile payment flows — server-controlled tokenization URLs, JavaScript-injection-into-WebView card-data exfiltration, JS-bridge token construction, and payment scope mismatches — and maps each to the detector that fires.
This skill should be used when the user asks about "business logic", "workflow vulnerability", "trust boundary", "state machine", "authorization bypass", "multi-step process", "workflow bypass", "application logic flaw", or needs to identify business logic vulnerabilities during whitebox security review.
This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key manipulation", "response caching", or needs to find cache-related vulnerabilities during whitebox security review.
This skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security", "Kubernetes security", "IMDS", "instance metadata", "S3 bucket policy", "IAM", "serverless security", "Lambda security", "container security", "cloud misconfiguration", "SSRF to cloud metadata", or needs to identify cloud-native security issues during whitebox security review.
| name | OWASP Category Mapping |
| description | Use this skill when the user asks for OWASP Top 10 mapping, CWE alignment, or standards-oriented reporting. The directory name stays `owasp-2025` for backward compatibility, but external reports should use official OWASP Top 10 names. |
| version | 2.0.0 |
Map VulnScout findings to official OWASP Top 10 category names, highlight what the plugin covers well, and keep reports aligned with widely recognized security terminology.
owasp-2025 directory name as a compatibility alias, not as proof of a future OWASP taxonomy.| OWASP Top 10 | VulnScout Coverage | Primary Skills |
|---|---|---|
| A01: Broken Access Control | Strong | business-logic, threat-modeling |
| A02: Cryptographic Failures | Strong | cryptographic-failures |
| A03: Injection | Strong | vuln-patterns, dangerous-functions, framework-patterns |
| A04: Insecure Design | Strong | business-logic, threat-modeling |
| A05: Security Misconfiguration | Strong | security-misconfiguration, framework-patterns |
| A06: Vulnerable and Outdated Components | Out of scope | (dependency and SBOM tooling) |
| A07: Identification and Authentication Failures | Moderate | vuln-patterns, business-logic |
| A08: Software and Data Integrity Failures | Moderate | vuln-patterns, sensitive-data-leakage |
| A09: Security Logging and Monitoring Failures | Strong | logging-failures, sensitive-data-leakage |
| A10: Server-Side Request Forgery | Strong | vuln-patterns, framework-patterns, vulnerability-chains |
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Out of scope for this plugin's code-review workflow. If the user needs this category:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
Use for:
Common CWE anchors:
When mapping a finding, prefer this shape:
- OWASP: A03 Injection
- CWE: CWE-89
- Why it fits: user-controlled input reaches SQL execution without parameter binding
hotspot into a reportable finding just to fill an OWASP bucket.na_cpg, not false_positive.