dstack-security

Plugin dstack-security from marketplace dstack in gosuda/dalcom-skills. Commands read from the repo's manifest — 3 days ago.

Skills (16)

• c-security-review

  Use when the user requests a userspace C or C++ security review with a threat model and severity filter and wants validated findings. Not for kernel or bare-metal code.

• chain-vulnerability-scanner

  Use when an Algorand, Cairo, Cosmos SDK, Solana, Substrate, or TON codebase needs vulnerability scanning with reachability-backed findings. Not for non-chain review: use security-review.

• codeql-security-analysis

  Use when building or reusing a CodeQL database, running CodeQL security analysis, or modeling project-specific sources and sinks. Not for manual vulnerability review: use security-review (mode: confirmed).

• function-audit-context-analyzer

  Use when asked for audit-context analysis of one function, or to build audit context across codebase before vulnerability hunting. Local write only. Not for vulnerability finding or severity rating.

• mermaid-to-proverif

  Use when a crypto Mermaid sequenceDiagram needs a ProVerif model for secrecy, authentication, replay, or forward-secrecy checks. Not for remote, credential, publish, deploy, or irreversible changes.

• project-findings-onto-graph

  Use when graph-backed security analysis is needed: project SARIF or reviewer findings onto a program graph; build or query a multi-language graph; summarize Trailmark structure; map smart-contract entry points; compare two refs or snapshots; or hunt confirmed vulnerability variants with pattern or g

• security-finding-verification

  Use when a named security allegation needs a true-positive or false-positive verdict. Not for discovering bugs: use security-review. Not for adding controls.

• smart-contract-guidelines-advisor

  Use when a smart-contract project needs architecture, testing, or a maturity scorecard. Use `guidelines` or `maturity` mode. Not for audits.

• smart-contract-secure-workflow

  Use when a smart-contract team invokes this before check-in or deployment. Not for audit prep. Not for guidelines: use smart-contract-guidelines-advisor.

• supply-chain-risk-auditor

  Use when assessing npm, PyPI, or Go dependency supply-chain risk, with lockfile-absent paths marked unassessable. Not for remote or irreversible changes.

• token-integration-analyzer

  Use when a token implementation or integration needs standards, privilege, nonstandard-behavior, and defensive-integration analysis. Not for source or remote-system changes.

• triage-security-finding

  Use when exactly one concrete security finding with a source anchor needs a verdict before PoC work. Not for projecting batches of findings onto a graph: use project-findings-onto-graph.

• vector-forge

  Use when crypto implementations and a vector harness need mutation-driven cross-implementation test vector expansion. Not for Wycheproof. For general fuzzing, use fuzzing.

• vulnerability-triage-brocards

  Use when a vulnerability report, CVE, bug-bounty submission, or automated finding needs triage before deep verification. Don''t use for tasks that require source or remote-system changes.

• yara-rule-authoring

  Use when writing, reviewing, optimizing, validating, or migrating YARA or YARA-X malware-detection rules, including CRX or DEX rules. Not for network IDS or memory-forensics rules.

• zeroize-audit

  Use when auditing C, C++, or Rust secret-handling code to verify zeroization survives compiler optimization. Not for test vectors.

Similar plugins