Results for “cert-spotter”

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Use when sources must stay traceable across sessions and years, when each reference needs a passport recording where it was found, how it was verified, and where it is cited, or when a draft needs a cited-but-unverified sweep before submission.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Run static BSP checks and on-target smoke/regression tests on a flashed NVIDIA Jetson device to validate a customized BSP image.

Executes Binance Spot API requests, including authenticated order management, with support for testnet and mainnet.

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles, covering review campaign design, reviewer selection, risk-based prioritization, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data using automated scraping and keyword matching to detect breaches early.

Audits OAuth 2.0 permissions across identity providers to identify over-privileged third-party integrations, excessive API scopes, and unused token grants, enforcing least-privilege access.

Audits codebases against PCI DSS v4.0, scanning for PAN patterns, CVV storage, and all 12 requirements including network security, encryption, access control, and logging. Estimates SAQ type for payment-handling systems.

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins using statistical analysis on Splunk or raw log data.

Scan for OSS tool opportunities from npm gaps, GitHub trends, and developer pain points

Review a ticket or PR through focused specialist lenses: scope, architecture, security, tests, AC coverage, and PR metadata.

Detects leaked secrets in Git repositories by scanning full commit history with Gitleaks rules and the GitHub Secret Scanning API, identifying exposed API keys, tokens, and credentials.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Official Puppeteer Model Context Protocol Server for browser automation.

Stops fantasy approvals, evidence-based certification - Default to "NEEDS WORK", requires overwhelming proof for production readiness

Evaluates Base ERC-20 tokens by contract address, returning a 0-100 score across five criteria, launch protocol classification, security flags, and a narrative interpretation.

Scans a project for stack signals and pain points, searches the skills-hub registry and local skills, scores candidates, and presents a ranked shortlist with install commands.

Performs authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.

Scaffolds a per-task verification skill for a repo, including a dev-local launcher, a browser driver, and a verification SOP that spawns a sub-agent to drive the app and produce proof.

Finds upsell and cross-sell opportunities in existing client accounts. Detects new product launches, traffic growth, hiring signals, funding events, and underutilized services. Maps opportunities to agency service offerings.

Provides guidance and best practices for working with cert-manager, covering setup, configuration, deployment, and troubleshooting.

Your customer-interview target finder. Connect Salesforce (CSM-managed customer book) and a canonical ICP doc — turns "who should I interview to validate the ICP, test the positioning, learn how they found us?" into a ranked slate of ~20 customers, each with a verdict, three-bullet why, and one named buying-committee recipient ready for a CSM-mediated intro. Use when a founder, GTM leader, or PMM is starting an ICP-validation round, testing new positioning, building a win-story program, or scouting reference customers. Trigger on "find customers to interview", "ICP validation interviews", "test our positioning with customers", "customer interview targets", "who in my book matches the ICP", "build a customer research slate", "find reference customers", "who should we talk to about how they found us", "validate the ICP with real customers", or any request to convert a CSM or AE book into a prioritized interview slate. Also fires when a new ICP doc ships and needs socializing with the customers who define it.

Audits a paper draft by tracing every numeric claim and assertion back to result files on disk, flagging untraced, mismatched, stale, uncited, and phantom references.

Verify academic citations against CrossRef, Semantic Scholar, and OpenAlex. Detects AI-hallucinated references, chimeric citations, and suspicious patterns.

Compare, cross-review, and merge competing plans from multiple agents into one executable direction with a clear handoff.

Guides implementation of GDPR Article 42-43 data protection certification mechanisms including accredited certification bodies, criteria development, and periodic review. Activate when pursuing privacy certifications, evaluating certification bodies, or developing certification criteria. Keywords: certification, Article 42, Article 43, accreditation, seal, privacy mark.

Validates, tests, and scores the quality of skills within a claude-skills ecosystem using Python scripts that check structure, syntax, runtime, and multi-dimensional quality metrics.

Verifies local changes, then commits and pushes the intended files on the current branch when explicitly requested.

Use this when reviewing or designing how secrets, API keys, service credentials, signing keys, tokens, and environment-specific credentials are stored, loaded, rotated, and kept out of untrusted runtimes.

Quality Gates

Verify signed artifacts and SLSA build provenance with Sigstore cosign and slsa-verifier, enforce keyless OIDC identity, and apply SLSA Build levels to harden the software supply chain.