Security

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks, scanning for controls and generating a compliance report.

Ranks any list of impediments and their countermeasures using a value-stream scoring model (ROI, Cost to Implement, Ease of Deployment, Risk Factor) and a fixed prioritization formula.

Enforce quality, security, and accessibility standards for Salesforce Lightning Web Components, Aura components, and Visualforce pages.

Govern Power Automate flows and Power Apps at scale by classifying business impact, detecting orphaned resources, auditing connectors, enforcing compliance, and computing archive scores — all without Dataverse or the CoE Starter Kit.

Verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each.

Compares Trailmark code graphs at two source code snapshots to surface security-relevant structural changes that text diffs miss, such as new attack paths, blast radius growth, and privilege boundary modifications.

Projects external audit findings from SARIF static analysis results and weAudit annotation files onto Trailmark code graphs as annotations and subgraphs, enabling cross-referencing with pre-analysis data like blast radius and taint.

Coverage-guided fuzzing for Ruby code and C extensions using libFuzzer and sanitizers.

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, or formal models (ProVerif/Tamarin) and generates Mermaid sequence diagrams with cryptographic annotations.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Detect memory errors like buffer overflows and use-after-free bugs in C/C++ code during fuzzing and testing using AddressSanitizer.

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Searches and extracts data from Burp Suite project files (.burp) using the burpsuite-project-file-parser extension, enabling regex searches on response headers and bodies, extraction of security audit findings, and analysis of proxy history and site map data.

Scans Cairo/StarkNet smart contracts for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, and signature replay. Use when auditing StarkNet projects.

Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.

Review documentation and prose for compliance with writing guidelines, checking style, voice, and tone against a fetched rule set.

Authenticate AI agents with services using ERC-8004 onchain identity via Sign-In With Agent (SIWA).

Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines.

Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level, covering the complete stack from database to UI.

Audits Amazon Ads profiles, campaigns, and performance across Sponsored Products, Brands, Display, and DSP, covering targeting, budgets, ACOS, TACOS, and policy compliance.

Authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

Provides a complete workflow for IDA Pro reverse engineering of binaries (PE, ELF, APK, DLL, SO, firmware) using bundled PowerShell scripts to manage the MCP server and open files, then leverages 72 MCP tools for survey, decompilation, cross-references, data-flow tracing, patching, and reporting.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

Provides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.

Reverse engineers stripped Go and Rust binaries by recovering runtime metadata, symbols, panic strings, and idiomatic decompilation patterns.

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

Reverse-engineers custom JavaScript-based WASM virtual machines and risk-control engines by identifying DSL VM patterns, extracting opcodes, analyzing constant tables, and tracing exported functions through static analysis and runtime injection.

Inspects web behavior, browser state, server routing, API order, and worker-backed application flow within a sandboxed CTF environment.

Analyze PCAP files by reconstructing TCP/UDP sessions, decoding application-layer protocols, and correlating packet sequences with host or malware behavior for CTF challenges.

Traces which sandbox node, proxy rule, or header-derived branch serves a live request in a CTF competition environment.

Audits a website against the Forter Agentic Readiness Guide by running 25 weighted rubrics, scoring each guideline, and producing a prioritized fix report.

Diagnose intermittent Wi-Fi issues like buffering, lag, packet loss, and weak coverage through read-only analysis, then safely optimize authorized router settings when evidence supports a change.

Automates reverse engineering of PE and ELF binaries by driving IDA with the WPeGPT plugin, producing structured reports on program purpose, network IoCs, suspicious functions, and vulnerability assessment.

Reviews a PR or diff through three independent lenses—correctness, security, and test coverage—then deduplicates and validates findings before persisting them, reducing noise while catching more real bugs.