Quality

Detects insecure file upload vulnerabilities in a codebase through a three-phase approach: discovery of upload endpoints, batched verification of bypass vectors, and consolidation of findings. Use when auditing for file upload, unrestricted upload, or extension bypass bugs.

Detects GraphQL injection vulnerabilities in codebases through a phased static analysis: recon for unsafe document assembly, batched verification of user-input traces, and merging results. Use when auditing GraphQL APIs for injection risks.

Detect hardcoded API keys, tokens, passwords, and other sensitive data in publicly accessible code such as frontend JavaScript, mobile apps, and HTML templates. Uses a three-phase approach with batch verification.

Detects IDOR vulnerabilities by analyzing endpoints for missing ownership or authorization checks. Uses a three-phase parallel subagent approach for efficient verification. Requires a prior SAST run (sast/architecture.md).

Scans a codebase to identify JWT issuance and verification sites, then checks for exploitable weaknesses like algorithm confusion, missing signature verification, weak secrets, and header injection attacks. Outputs a structured findings report for security remediation.

Detects missing authentication and broken function-level authorization vulnerabilities via a three-phase approach (recon, parallel endpoint verification, merge). Use when asked to find missing auth, broken access control, or privilege escalation bugs.

Detect path traversal vulnerabilities via reconnaissance of file-loading sinks, batched verification with parallel subagents, and report merging. Ideal for security assessments focused on directory traversal or file disclosure bugs.

Automated static analysis to detect Remote Code Execution vulnerabilities, including OS command injection, code injection, and unsafe deserialization. Use when auditing code for critical security bugs.

Consolidates SAST vulnerability scan results into a single final report ranked by severity and confidentiality impact, reading all *-results.md files and producing sast/final-report.md. Use after running vulnerability detection skills to summarize security findings.

Detects SQL injection vulnerabilities in codebases by identifying unsafe string concatenation, f-strings, ORM raw queries, and dynamic identifiers in SQL construction. Run when auditing for database injection flaws.

Detects Server-Side Request Forgery (SSRF) vulnerabilities in code using a three-phase approach: recon, batched verify, and merge. Ideal for security audits when looking for SSRF bugs in server-side code.

Detect Server-Side Template Injection (SSTI) vulnerabilities using a three-phase approach with parallel subagents. Run when asked to find SSTI or template injection bugs.