一键导入
Skills_Sec
Skills_Sec 收录了来自 ciandt-copilot 的 6 个 skills，并提供仓库级职业覆盖和站内 skill 详情页。
这个仓库中的 skills
Audits project dependencies (npm, pip, Go, Maven, Gradle) for CVEs, supply chain risks, typosquatting, and dependency confusion attacks.
Performs Static Application Security Testing (SAST) on source code, identifying OWASP Top 10 vulnerabilities, critical CWEs, and insecure patterns with prioritized remediation.
Generates and audits Software Bill of Materials (SBOM) in SPDX/CycloneDX format, evaluating supply chain integrity, component risks, and regulatory compliance.
Conducts structured threat modeling (STRIDE) for features and systems, identifying attack vectors, supply chain threats, and mitigation controls at the beginning of the SDLC.
Detects hardcoded secrets, credentials, and sensitive data in source code, configuration files, and scripts before they reach the repository.
Performs a complete security review of Pull Requests and code diffs, covering business logic, attack surface, OWASP ASVS compliance, and IaC security with a formal merge verdict.