utkusen/sast-skills

Detects business logic vulnerabilities in codebases using a three-phase approach combining threat modeling, parallel verification of attack scenarios, and result merging. Use when finding logic flaws, workflow bypasses, or abuse-of-function bugs.

Detect Cross-Site Scripting vulnerabilities in codebases via a three-phase SAST approach: recon, batched verification with subagents, and merge. Use when analyzing web application source code for XSS bugs.

Detect GraphQL injection vulnerabilities by tracing user input to unsafe operation document assembly sites. Use for security audits and code reviews of GraphQL APIs.

Detects hardcoded sensitive data (API keys, tokens, passwords) in publicly accessible code like frontend JavaScript, mobile apps, and HTML templates. Uses recon, verify, and merge phases. Requires architecture analysis first.

Detect IDOR vulnerabilities by identifying endpoints lacking ownership checks, using automated recon, parallel batch verification, and merge. Ideal for code security audits targeting authorization bypass.

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery, batched verify, and merge. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.

Analyzes codebases for insecure JWT implementations: maps token lifecycle, then checks verification sites for algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation.

Detects insecure JWT implementations in codebases. Uses a two-phase approach: mapping JWT issuance/verification sites, then checking for weaknesses such as algorithm confusion, missing signature verification, weak secrets, and missing claim validation. Ideal for finding token forgery or authentication bypass bugs.

Detects missing authentication and broken function-level authorization vulnerabilities via a three-phase recon-batch-merge approach. Use when asked to find unauthenticated endpoints or vertical privilege escalation bugs.

Detects path traversal vulnerabilities in a codebase using a three-phase approach: recon, batched verify, and merge. Use when auditing code for file disclosure or directory traversal bugs.

Detects remote code execution vulnerabilities (command injection, eval injection, unsafe deserialization) by finding dangerous sinks and tracing user input with parallel subagents. Use when auditing code for critical injection flaws.

Performs initial reconnaissance of a codebase for security assessments, mapping technology stack, architecture, entry points, data flows, and trust boundaries. Produces an architecture report to guide subsequent vulnerability detection.

Consolidates findings from multiple SAST result files into a final security report ranked by severity and confidentiality impact. Use after running individual vulnerability scans to generate a comprehensive assessment summary.

Detects Server-Side Template Injection (SSTI) vulnerabilities by scanning for dynamic template rendering sites, then tracing user input flows in parallel to verify exploitability, and consolidating results. Use when auditing for template injection bugs.

Automatically detects SQL injection vulnerabilities in a codebase using a three-phase SAST approach with parallel subagents. Use when asked to find SQLi or database injection bugs.

Detect Server-Side Request Forgery (SSRF) vulnerabilities in codebases using a three-phase approach: recon, batched verification, and merging results. Use for security assessments when asked to find SSRF bugs.

Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon, batched verify, and merge. Use when asked to find XXE or XML injection bugs.