Vulnerability Scanning Agent Skills

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.

Assess AI/ML systems for prompt injection, jailbreak vulnerabilities, model inversion risk, data poisoning exposure, and agent tool abuse, with MITRE ATLAS mapping and guardrail recommendations.

Review GitHub PRs and GitLab MRs with structured analysis including blast radius, security scanning, test coverage delta, breaking change detection, and performance impact.

Run security audits, vulnerability scans, compliance checks, and incident response workflows for application security.

Audit and manage dependencies across multi-language projects by scanning for vulnerabilities, license conflicts, and transitive dependency risks, with safe-upgrade planning.

Assess cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, and IaC security gaps across AWS, Azure, and GCP with MITRE ATT&CK mapping.

Routes security requests to specialist skills and performs STRIDE/DREAD threat modeling with a quick secret scan.

Scan and audit AI agent skills for security risks before installation, producing a PASS/WARN/FAIL verdict with findings and remediation guidance.

Fetches IAM recommendations and security insights from Google Cloud for a specified organization, folder, or project, using MCP tools, gcloud CLI, or direct API calls.

Audit Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

Secure Django applications against common vulnerabilities with production-ready settings, authentication, authorization, and input validation.

Secure Laravel applications with best practices for authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and deployment configurations.

Provides a security checklist and hardened code examples for Solidity AMM contracts, covering reentrancy, donation attacks, oracle manipulation, slippage, and admin controls.

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Run Bumblebee supply-chain inventory and exposure scans on macOS/Linux to detect compromised packages, extensions, and MCP host configs.

Review local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist-driven process.

Analyze git repositories to build a security ownership topology mapping people to files, compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization.

Perform evidence-backed security audits for the Adobe Dispatcher Apache HTTP Server module and related HTTPD configuration in AMS workflows.

Scans agent skills for security issues including prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

Audits GitHub Actions workflows for exploitable vulnerabilities with concrete attack scenarios.

Configure and run CodeQL code scanning through GitHub Actions workflows or the standalone CLI for security analysis.

Configure and manage GitHub Dependabot for automated dependency updates, security alerts, and vulnerability scanning across multiple ecosystems.

Detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using the Resemble AI platform.

Scans codebases for security vulnerabilities by reasoning about code context, data flow, and component interactions, covering injection flaws, secrets exposure, authentication issues, and weak cryptography across multiple languages.

Performs STRIDE-A threat model analysis of repositories and systems, producing architecture overviews, DFD diagrams, prioritized findings, and executive assessments. Supports both single analysis and incremental updates with change tracking.

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with support for multiple languages, scan modes, and data extension models.

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

Parse, analyze, and process SARIF files from static analysis tools like CodeQL and Semgrep, including filtering, deduplication, aggregation, and CI/CD integration.

Find similar vulnerabilities and bugs across codebases using pattern-based analysis after identifying an initial issue.

Write high-quality YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.

Identifies state-changing entry points in smart contract codebases for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.

Analyzes cryptographic code to detect operations that leak secret data through execution timing variations, supporting multiple languages.

Detect timing side channels in cryptographic code using formal, symbolic, dynamic, and statistical testing tools.