Results for “security-scan”

Provides a comprehensive penetration testing toolchain with 20+ security tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, etc.) exposed via MCP servers for authorized vulnerability scanning, exploitation, and reporting.

Scans local repos and AI agent skill folders for security drift, saves trusted baselines, and compares changes after updates to highlight risky new capabilities.

Configure and manage GitHub Dependabot for automated dependency updates, security alerts, and vulnerability scanning across multiple ecosystems.

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

Audit Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

Performs a full-stack security posture assessment with 0-100 risk scoring, scanning dependencies, code patterns, configuration, and data handling, then produces a prioritized report and routes to specialized skills.

Automates REST API security testing using the OWASP ZAP Python SDK, running active scans, SQL injection probes, and XSS tests against OpenAPI specs with structured vulnerability reports.

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Audits codebases against PCI DSS v4.0, scanning for PAN patterns, CVV storage, and all 12 requirements including network security, encryption, access control, and logging. Estimates SAQ type for payment-handling systems.

Scans Cairo/StarkNet smart contracts for 6 critical vulnerability patterns including arithmetic overflow, L1-L2 messaging issues, and signature replay. Use when auditing StarkNet projects.

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.

Configures Fail2ban with custom filters and actions to detect port scanning, SSH brute force, and network reconnaissance, automatically banning offending IPs and alerting security teams.

Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, using a structured checklist and verification process.

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for code, infrastructure, and cloud environments.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, producing a prioritized report with severity ratings and concrete fixes.

Runs Semgrep static analysis to find bugs and security vulnerabilities, with guidance on installation, rule selection, custom rule writing, and CI/CD integration.

Generate CycloneDX and SPDX SBOMs from container images and filesystems, scan them for vulnerabilities with Grype, and sign attestations with Cosign for supply-chain trust.

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan.

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.

Audit installed SKILL.md files and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and obfuscation. Integrates with Bankr Safety Scores and produces delta reports against prior scans.

Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.

Detect and prevent public-over-private name resolution in npm, PyPI, and Maven dependency manifests.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Configure and manage Harbor container registry with security features including vulnerability scanning, image signing, RBAC, content trust, and audit logging.

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Runs Semgrep static analysis via the semgrep CLI with custom YAML rule packs, supports community rules, parses JSON output, and integrates with the Semgrep App API for findings management.

Systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardcoded keys, insufficient entropy, and protocol misconfigurations.

Run NVIDIA garak probe suites against an LLM endpoint to test for jailbreaks, prompt injection, data leakage, and toxic generation, then interpret the hit-rate report for triage and reporting.