涵盖漏洞扫描、渗透测试、代码审计、依赖安全、OWASP、合规检查等
by @trailofbits
Trail of Bits security audit methodology. Line-by-line code analysis using First Principles, 5 Whys, and 5 Hows. Identifies invariants, assumptions, and cross-function flows before writing findings.
by @snyk
Seven-phase security workflow: scan with Snyk, analyze findings, fix vulnerabilities, validate fixes. Handles both code and dependency vulnerabilities automatically.
by @AgentSecOps
Hardcoded secret detection using Gitleaks. Scans commit history, staged files, and working tree for API keys, tokens, passwords. Integrates with pre-commit hooks.
Security scanner for AI agent skills and MCP servers. Detects prompt injection, sensitive data handling, malicious payloads, and supply chain compromise in SKILL.md files.
Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for automated vulnerability detection across codebases.
by @mxyhi
Enforce writing tests before implementation. RED-GREEN-REFACTOR cycle with anti-pattern detection and coverage enforcement.
Static Application Security Testing using Semgrep. Automated vulnerability detection mapped to OWASP Top 10 and CWE standards with inline fix suggestions.
Audit supply-chain threat landscape of project dependencies. Detects typosquatting, compromised packages, and known CVEs.
by @agamm
OWASP Top 10:2025 and ASVS 5.0 with code review checklists and language-specific security quirks for Python, Node.js, Go, and Java.
by @obra
Implement multi-layered testing and security best practices. Defense layers for validation, authorization, rate limiting, and error handling.
YARA detection rule authoring with linting, atom analysis, and best practices for malware detection and threat hunting.
by @Eyadkelleh
AI/ML security testing covering prompt injection, bias detection, data leakage, adversarial resistance, and model extraction prevention.
by @wshobson
OWASP Top 10 protection implementation throughout the development lifecycle with language-specific security patterns.
Systematic exploratory testing with screenshots, video recording, and reproducible evidence. Structured test sessions with bug tracking.
by @microsoft
Azure RBAC (Role-Based Access Control) management: role assignments, custom roles, and least-privilege enforcement.
by @davila7
Determines and implements compliance frameworks: SOC2, ISO 27001, HIPAA, HITRUST for different organization types.
by @supercent-io
security-best-practices from supercent-io/skills-template
by @pbakaus
Audit — Security & Compliance skill for AI coding agents.