security

Plugin security from marketplace security-skills in mn-youssef/security-skills. Commands read from the repo's manifest — 1 month ago.

Skills (16)

• access-control-testing

  Use when testing whether users can access data or actions they shouldn't — IDOR/BOLA, horizontal and vertical privilege escalation, multi-tenant isolation, forced browsing, function-level authorization (BFLA), and mass assignment. The #1 cause of real-world breaches.

• active-pentest

  Use when you need to actually run security tests against a running application you own or are authorized to test — the shared execution harness for lab/proxy/scanner setup, safe non-destructive execution, and standardized proof-of-concept capture that the find/exploit specialist skills rely on.

• api-security-testing

  Use when testing REST, GraphQL, gRPC, or WebSocket APIs against the OWASP API Security Top 10 — object- and function-level authorization (BOLA/BFLA), excessive data exposure, mass assignment, unrestricted resource consumption, and GraphQL-specific abuse. For apps you own or are authorized to test.

• authentication-testing

  Use when testing login, sessions, password reset, OAuth/OIDC/SAML/SSO, MFA, and JWTs for weaknesses that lead to account takeover — credential attacks, session fixation, reset-token poisoning, MFA bypass, and token forgery. On apps you own or are authorized to test.

• business-logic-testing

  Use when testing application-specific workflow and business-rule flaws that scanners cannot find — price/quantity/parameter tampering, workflow and state-machine bypass, race conditions and TOCTOU, replay, and abuse of coupons/refunds/limits. Requires understanding what the app is supposed to do.

• client-side-exploitation

  Use when testing advanced browser-side and HTTP-layer attacks beyond basic XSS/CSRF — DOM XSS, CSP bypass, CORS misconfiguration exploitation, postMessage abuse, prototype pollution, DOM clobbering, clickjacking, web cache poisoning, and HTTP request smuggling. On apps you own or are authorized to t

• file-upload-and-ssrf

  Use when testing file-upload handling, server-side request forgery (SSRF), and insecure deserialization — upload bypasses (type/extension/content, polyglots, path traversal), SSRF to cloud metadata and internal services, and unsafe deserialization sinks. On apps you own or are authorized to test.

• injection-testing

  Use when dynamically testing whether untrusted input reaches an interpreter — SQL/NoSQL injection (incl. blind/time-based), OS command injection, server-side template injection (SSTI), XXE, LDAP/XPath, and CRLF/header injection. Confirms on a running app what security-code-audit finds in source.

• pentest-reporting

  Use when turning security findings into a clear, actionable report — scoring severity with CVSS, writing findings with reproduction and impact, prioritizing remediation, producing an executive summary, and tracking retests to closure. The phase that makes testing matter.

• recon-and-osint

  Use when starting an assessment and you need to discover an application's full attack surface — subdomains, hosts, endpoints, technologies, exposed services, leaked credentials and secrets — on assets you own or are authorized to test. Feeds the threat model with real, not assumed, targets.

• secrets-management-audit

  Use when hunting for exposed secrets and auditing how an app you own manages them — API keys, tokens, passwords, and private keys in source, git history, binaries, logs, config, and CI; plus vaulting, rotation, and least-privilege of the secrets themselves.

• security-code-audit

  Use when you have application source code and want to find security vulnerabilities by reading it — covers OWASP Top 10 across frontend, backend API, and database. Produces a findings register with severity, file:line, and exploitability.

• security-hardening

  Use when you have a security finding (from code audit or pentest) and need to fix it correctly with secure-coding patterns, then verify the fix actually closes it. Covers fixes for injection, access control, XSS, auth, secrets, and config across the stack.

• security-testing

  Use when you want to security-test, pentest, audit, or find vulnerabilities in an application you own or are authorized to test — entry point that confirms authorization and routes to the right phase (threat model, code audit, active test, or hardening).

• threat-modeling

  Use when starting a security assessment and you need to map an application's attack surface, enumerate trust boundaries, and rank what to test first — before auditing code or running tools. Produces a prioritized target list.

• vulnerability-chaining

  Use when you have multiple findings and need to combine them into realistic end-to-end attack paths — turning several low/medium issues into a single critical-impact exploit chain. The red-team-lead skill that ties the specialists' findings together into business impact.

Similar plugins