메뉴
External software analysis workflows for binaries/packages (decompilation, reverse engineering, static analysis, fuzzing, and evidence collection). Use when analyzing third-party software without source access.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Query multi-source AppSec catalogs (CWE / OWASP Cheat Sheet Series / GitHub Advisory Database / AppSec.fyi) for a given security finding and propose a synthesis row to the security-field-notes synthesis-ledger via PR. Use when a producer skill (sec-audit-static, sec-audit-dast, external-software-analysis) emits a finding that needs external reference enrichment, or when packaging an assessment finding for downstream remediation context.
Transform security assessment deliverables from static documents (Word/Excel/portal) into version-controlled, executable projects. PoCs replace narrative claims; saved HTTP requests replace checkboxes; commit hashes enable exact-state reproduction. Use when scoping methodology for an audit, when an existing assessment needs to be made reproducible, or when assessment outputs must be inheritable across teams.
DAST/ASM workflow for external asset discovery, probing, and scanning with SARIF output. Use for runtime/endpoint-based assessments and asset management scanning.
Static code security audit playbook (SAST, SCA, secret detection) with standardized JSON outputs and reporting. Use for source-code based assessments, schema validation, and generating final reports.
Dataflow-based code clustering for security assessments. Groups (Endpoint, Sink) paths by shared review strategy so reviewers sample representative cases instead of exhaustively reviewing every path. Use when scoping manual review on a codebase with 50+ endpoints, repetitive sanitization patterns, or after initial SAST/SCA produces large finding sets that need triage.
Security architecture review for codebases, producing Data Flow Diagram (DFD) with trust boundaries, Attack Flow overlay, scoped attack surface inventory, sensitive data map, and risk summary grounded in code. Use when asked to perform architecture-focused security review, reconstruct security design from code, or produce DFD/attack-flow documentation.
| name | external-software-analysis |
| description | External software analysis workflows for binaries/packages (decompilation, reverse engineering, static analysis, fuzzing, and evidence collection). Use when analyzing third-party software without source access. |
Guide external software analysis from decompilation to vulnerability discovery and evidence collection. Output is a structured Markdown report.
references/external_sources.md for local canonical references.references/severity_criteria.md and references/severity_criteria_detail.md.schemas/finding_schema.json and include:
provenance (one of binary-confirmed|source-confirmed|runtime-confirmed|not-confirmed)impacted_flow (one or more flow IDs such as F1, F2)finding_id -> impacted flow/boundary)binary-confirmed, source-confirmed, runtime-confirmed, not-confirmedreferences/architecture_handoff.md.references/severity_criteria.md and detailed criteria in references/severity_criteria_detail.md.schemas/reporting_summary_schema.json in this skill directory.schemas/task_output_schema.json.scripts/generate_reporting_summary.py in this skill directory to build JSON output../external-analysis-architecture-handoff.md) using references/architecture_handoff.md.references/external_sources.mdreferences/external_report_template.mdreferences/discovery_process.mdreferences/severity_criteria.mdreferences/severity_criteria_detail.mdreferences/reporting_summary.mdreferences/architecture_handoff.mdschemas/reporting_summary_schema.jsonschemas/task_output_schema.jsonschemas/finding_schema.jsonscripts/generate_reporting_summary.py