vchirrav-eng
- 39 skills
- 0 followers
- 6 hours ago last updated
- ▌ Semgrep Sast Scan · vchirrav-eng bundleRun Semgrep SAST (Static Application Security Testing) scans on source code using the Semgrep AppSec Platform cloud instance. Use this skill whenever the user asks to run a SAST scan, static analysis, code security scan, vulnerability scan on source code, or mentions "semgrep scan", "security scan", "code scan", "SAST", or "static analysis". Also trigger when the user wants to check code for security issues, find vulnerabilities, audit code for OWASP risks, or run Semgrep Code. This skill handles full scans, diff-aware scans, and cross-file analysis via the Semgrep cloud organization.
- ▌ Semgrep Secret Scan · vchirrav-eng bundleRun Semgrep Secrets scanning to detect leaked credentials, API keys, passwords, and access tokens in source code. Use this skill whenever the user asks to scan for secrets, detect leaked credentials, find API keys in code, run secret detection, check for hardcoded passwords, or mentions "semgrep secrets", "secret scan", "credential scan", "key leak", or "token exposure". Also trigger when the user wants to scan Git history for leaked secrets, validate whether detected secrets are still active, or audit a repository for sensitive data exposure. This skill connects to the Semgrep AppSec Platform cloud instance for enhanced detection with semantic analysis, entropy analysis, and HTTP validation of discovered secrets.
- ▌ Dast Zap · vchirrav-engRun OWASP ZAP for Dynamic Application Security Testing. Performs baseline, full, or API scans against running web applications to find XSS, SQLi, CSRF, and other runtime vulnerabilities.
- ▌ Sbom Syft · vchirrav-engRun Syft to generate Software Bill of Materials (SBOM) from container images and filesystems. Outputs CycloneDX or SPDX formats for supply chain compliance.
- ▌ Sca Grype · vchirrav-engRun Anchore Grype for SCA vulnerability scanning on filesystems and container images. Matches dependencies against multiple vulnerability databases (NVD, GitHub, OS advisories).
- ▌ Sast Gosec · vchirrav-engRun gosec SAST scans on Go code. Detects SQL injection, hardcoded credentials, insecure TLS, command injection, and other Go security issues.
- ▌ Sast Psalm · vchirrav-engRun Psalm with taint analysis on PHP code. Detects SQL injection, XSS, command injection, path traversal, and other taint-flow vulnerabilities in PHP applications.
- ▌ Dast Nuclei · vchirrav-engRun Nuclei template-based vulnerability scanner. Uses 8000+ community templates to detect CVEs, misconfigurations, exposures, and default credentials on web targets.
- ▌ Sast Bandit · vchirrav-engRun Bandit SAST scans on Python code. Detects common security issues like SQL injection, hardcoded passwords, exec usage, and insecure crypto.
- ▌ Sast Detekt · vchirrav-engRun detekt static analysis on Kotlin code with security-focused rules. Detects hardcoded secrets, insecure crypto, and code quality issues affecting security.
- ▌ Sast Semgrep · vchirrav-engRun Semgrep SAST scans on code. Supports 30+ languages with OWASP, security, and custom rulesets. Parses results and provides remediation guidance.
- ▌ Sast Brakeman · vchirrav-engRun Brakeman SAST scans on Ruby on Rails applications. Detects SQL injection, XSS, mass assignment, CSRF, command injection, and other Rails-specific vulnerabilities.
- ▌ Sast Spotbugs · vchirrav-engRun SpotBugs with Find Security Bugs plugin on Java code. Detects injection flaws, XXE, insecure crypto, SSRF, deserialization, and other JVM security bugs.
- ▌ Sca NPM Audit · vchirrav-engRun npm audit for Node.js dependency vulnerability scanning. Built-in SCA for npm projects with automatic fix suggestions.
- ▌ Sca Pip Audit · vchirrav-engRun pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.
- ▌ Iac Scan Tfsec · vchirrav-engRun tfsec (now part of Trivy) to scan Terraform code for security misconfigurations. Deep HCL analysis with support for Terraform modules, variables, and expressions.
- ▌ Sast Flawfinder · vchirrav-engRun Flawfinder SAST scans on C/C++ code. Detects buffer overflows, format string vulnerabilities, race conditions, and other memory safety issues.
- ▌ Sca Osv Scanner · vchirrav-engRun Google's OSV-Scanner for Software Composition Analysis. Scans lockfiles and SBOMs across all major ecosystems (npm, PyPI, Maven, Go, Cargo, NuGet, RubyGems) for known vulnerabilities.
- ▌ Iac Scan Checkov · vchirrav-engRun Checkov to scan Infrastructure as Code for misconfigurations. Supports Terraform, CloudFormation, Kubernetes, Helm, ARM, Ansible, and Dockerfiles.
- ▌ Sast Cargo Audit · vchirrav-engRun cargo-audit and cargo-geiger on Rust code. Audits dependencies for known vulnerabilities and detects unsafe code usage for memory safety review.
- ▌ Tls Scan Testssl · vchirrav-engRun testssl.sh to analyze TLS/SSL configurations. Checks cipher suites, protocols, certificate validity, known vulnerabilities (Heartbleed, POODLE, ROBOT), and compliance.
- ▌ Malware Scan Yara · vchirrav-engRun YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
- ▌ Network Scan Nmap · vchirrav-engRun Nmap for network discovery and security auditing. Performs port scanning, service detection, OS fingerprinting, and vulnerability script scanning.
- ▌ Secure Coding Audit · vchirrav-engAudit code for security vulnerabilities using OWASP Secure Coding rules. Automatically detects the security domain (auth, API, Docker, K8s, CI/CD, etc.) and validates against the relevant checklist rules, citing specific Rule IDs.
- ▌ Container Scan Trivy · vchirrav-engRun Trivy to scan container images for OS and library vulnerabilities, misconfigurations, and secrets. Comprehensive multi-target security scanner.
- ▌ Iac Scan Kube Linter · vchirrav-engRun KubeLinter to lint Kubernetes YAML and Helm charts for security best practices. Checks pod security, resource limits, network policies, and RBAC.
- ▌ Sast Eslint Security · vchirrav-engRun ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.
- ▌ Secret Scan Gitleaks · vchirrav-engRun Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.
- ▌ API Security Spectral · vchirrav-engRun Spectral to lint OpenAPI and AsyncAPI specs for security issues. Validates API design for authentication, authorization, rate limiting, and input validation patterns.
- ▌ Container Scan Dockle · vchirrav-engRun Dockle to audit container images against CIS Docker Benchmark and best practices. Checks for running as root, sensitive files, HEALTHCHECK, and more.
- ▌ License Scan Scancode · vchirrav-engRun ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across codebases.
- ▌ Mobile Security Mobsf · vchirrav-engRun MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.
- ▌ Cloud Security Prowler · vchirrav-engRun Prowler for comprehensive cloud security posture assessment. Audits AWS, Azure, and GCP against CIS Benchmarks, PCI-DSS, HIPAA, GDPR, and other compliance frameworks.
- ▌ Secret Scan Trufflehog · vchirrav-engRun TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.
- ▌ Secure Coding Generate · vchirrav-engGenerate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g., [INPUT-04], [AUTH-07]) plus a rules-applied summary.
- ▌ Container Scan Hadolint · vchirrav-engRun Hadolint to lint Dockerfiles for best practices and security issues. Validates against Docker and ShellCheck rules.
- ▌ API Security Schemathesis · vchirrav-engRun Schemathesis for property-based API security testing. Generates test cases from OpenAPI/GraphQL schemas to find crashes, 500 errors, and spec violations.
- ▌ Cloud Security Scoutsuite · vchirrav-engRun ScoutSuite for multi-cloud security auditing. Collects configuration data from AWS, Azure, GCP, Oracle, and Alibaba Cloud and generates an interactive security report.
- ▌ Dependency Confusion Detect · vchirrav-engRun Confused and GuardDog to detect dependency confusion and typosquatting risks. Checks if internal package names exist on public registries and identifies malicious packages.