Browse Skills

Detects Cross-Site Scripting (XSS) vulnerabilities in codebases through a three-phase approach: recon for sink sites, batched taint tracing with subagents, and merging results. Use when asked to find XSS bugs.

Detects Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon, batched verify, and merge. Requires sast/architecture.md from prior architectural analysis.

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input), and merge results. Use when asked to find SSRF bugs.

Detects SQL injection vulnerabilities in codebases using a three-phase approach: recon, batched verification, and merge. Covers string concatenation, f-strings, unsafe ORM methods, and dynamic identifiers. Use when auditing code for database injection bugs.

Aggregates SAST scan results into a final ranked security report, prioritizing by severity and confidentiality impact. Use after vulnerability scans to generate a consolidated summary.

Detects Remote Code Execution vulnerabilities using a three-phase approach: recon, batched verification with parallel subagents, and merge. Covers OS command injection, code injection, and unsafe deserialization. Requires prior architecture analysis.

Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon, batched verification, and merge. Use when asked to find path traversal, directory traversal, or file disclosure bugs. Requires prior SAST architecture analysis.

Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase static analysis approach. Use when reviewing code for access control flaws, vertical privilege escalation, or unauthenticated endpoints.

Detects insecure JWT implementations in codebases by mapping issuance and verification sites, then identifying algorithm confusion, missing signature verification, weak secrets, and other exploitable weaknesses.

Detects Insecure Direct Object Reference (IDOR) vulnerabilities in codebases using a three-phase approach: recon, batched verification, and merge. Use when auditing applications for authorization bypass bugs where user-supplied identifiers lack ownership checks.

Detects hardcoded API keys, tokens, passwords, and other secrets in publicly accessible code. Uses a three-phase approach combining recon, batched verification, and merging to identify real exposures in frontend, mobile, and client-side bundles.

Detect GraphQL injection vulnerabilities by finding where user input is unsafely incorporated into GraphQL operation documents. Uses a three-phase agent pipeline to scan your codebase and report findings.