🎯Skills35
A CodeIgniter framework security audit skill that performs white-box static analysis covering CSRF protection, XSS output filtering, SQL injection via query concatenation, session/cookie security, and authentication/access control, mapping findings to standard vulnerability type codes.
A ThinkPHP framework security audit skill that performs white-box static analysis covering authentication bypass, CSRF protection gaps, template engine XSS via raw output, ORM mass assignment vulnerabilities, raw SQL injection points, and debug/config exposure risks.
A WordPress framework security audit skill that performs white-box static analysis on nonce/capability checks, AJAX actions, output escaping, $wpdb query parameterization, redirect safety, file uploads, and remote requests, mapping findings to vulnerability categories like CSRF, XSS, SQL injection, and SSRF.
A PHP source code audit skill that identifies SQL injection vulnerabilities by tracing user input to SQL execution points across PDO, mysqli, and ORM patterns, then outputs detailed reports with severity ratings, proof-of-concept payloads, and remediation guidance.
A PHP XSS security audit skill that analyzes PHP source code to identify cross-site scripting vulnerabilities across HTML, attribute, JavaScript, URL, and template contexts, with severity grading, proof-of-concept payloads, and remediation guidance.
A PHP source code command injection audit skill that identifies command execution sinks (exec, system, shell_exec, etc.), traces user input into command construction points, and outputs exploitability ratings with PoC exploits and remediation recommendations.
A white-box security audit skill for the Yii2 PHP framework that statically analyzes access control (AccessControl/RBAC), CSRF protection, input filtering, output encoding, and URL/redirect safety, mapping findings to a standardized vulnerability taxonomy.
A Laravel framework security audit skill that performs white-box static analysis covering authentication and route protection, CSRF token handling, session and cookie security, Eloquent mass assignment vulnerabilities, Blade template XSS risks, and signed URL verification.
A PHP security audit skill that identifies Server-Side Request Forgery (SSRF) vulnerabilities by tracing user-controllable URLs into network request sinks like curl_exec, file_get_contents, and fsockopen. Outputs exploitability ratings, proof-of-concept payloads, and remediation recommendations.
A PHP source code audit skill focused on file upload security, detecting arbitrary file upload, path traversal, and executable upload risks through static analysis with structured evidence grading and PoC generation.
A PHP source code audit skill for identifying XXE (XML External Entity) vulnerabilities, analyzing XML parser configurations, input sources, and echo paths, and generating severity-rated reports with proof-of-concept exploits and remediation guidance.
A PHP source code audit skill that identifies arbitrary file write vulnerabilities by tracing user-controllable data to write sinks, detecting path traversal to write destinations, and evaluating post-write executability for potential remote code execution.
A PHP code audit skill that traces data flow from HTTP routes and CLI entry points to sensitive sink operations (SQL, commands, file access, SSRF, XSS, deserialization). Outputs call chain evidence, branch execution paths, and parameter controllability analysis without making vulnerability conclusions.
A PHP business logic vulnerability auditing skill that detects Mass Assignment, workflow bypass, race conditions, state machine defects, and payment timing flaws. It outputs evidence chains, severity ratings, PoC request sequences, and remediation guidance for each finding.
A PHP source code audit skill that identifies authentication and authorization mechanisms across all routes, detects bypass vulnerabilities and IDOR risks, and generates route-auth mapping tables with PoC exploits and remediation recommendations.
A PHP source code audit skill that detects deserialization and object injection vulnerabilities by identifying unserialize injection points, tracing user-controllable input sources, and analyzing magic method gadget chains to assess exploitability.
A PHP dependency vulnerability scanner that analyzes composer.json and composer.lock files to identify known CVEs, with affected route inference and trigger-point analysis. Outputs structured reports with severity classification, code reference locations, and remediation recommendations for each vulnerability.
A PHP source code audit skill for CSRF vulnerabilities that analyzes state-changing interfaces for CSRF protection, traces token generation and validation flows, and outputs exploitability ratings with PoC examples and remediation advice.
Audits PHP source code for encryption and key security issues, detecting weak hashing (MD5/SHA1), insecure encryption modes, JWT/HMAC signature verification flaws, and hardcoded keys, with severity-rated findings, PoC, and remediation guidance.
A PHP source code audit skill that identifies NoSQL injection vulnerabilities by tracing user input into MongoDB and DocumentDB query construction, detecting operator injection ($gt, $ne, $where), and providing severity ratings with PoC and remediation advice.
A PHP source code audit skill for detecting arbitrary file read and path traversal vulnerabilities. Identifies file read sinks, traces path sources, analyzes bypass techniques, and outputs exploitability ratings with PoC and remediation guidance.
A security audit skill for Symfony framework projects that performs white-box static analysis on access control, CSRF protection, Twig template rendering, expression-based authorization, and HttpClient SSRF risks, mapping findings to standard vulnerability categories.
A PHP security audit skill focused on filesystem operations such as mkdir, chmod, symlink, and unlink, detecting vulnerabilities like path traversal, TOCTOU race conditions, and privilege escalation chains in PHP projects.
A PHP web application whitebox security audit pipeline skill that orchestrates sub-audit skills by sink type for comprehensive source code vulnerability analysis, covering route mapping, auth auditing, and vulnerability scanning.
A PHP source code audit skill that identifies expression injection vulnerabilities where user-controllable strings enter expression engines or code execution functions, outputting exploitability grading, PoC, and remediation advice.
A PHP source code audit skill specialized in detecting template injection (SSTI) and dangerous expression execution risks, analyzing template engine rendering points, user-controllable inputs, and execution chains across Twig, Blade, Smarty, and custom engines.
A PHP source code security audit skill that detects session fixation, insecure cookie flags, JWT verification flaws, and remember-me vulnerabilities, producing severity-graded findings with PoC examples and remediation guidance.
A PHP exploit chain aggregator skill that chains confirmed vulnerabilities from individual audit reports into cross-stage exploitation narratives based on prerequisite satisfaction, outputting chain exploitability assessments determined by the weakest link.
A skill that teaches AI agents the Bun runtime API, covering file I/O, shell execution, SQLite, SQL client for PostgreSQL and MySQL, S3 storage, Redis, hashing, compression, and other built-in utilities.
A security audit skill for identifying Zip Slip and path traversal vulnerabilities in PHP archive extraction code. It traces extraction call sites, analyzes entry name sanitization, verifies base directory constraints, and outputs exploitability ratings with proof-of-concept details and remediation guidance.
A PHP source code audit skill that detects CRLF injection and HTTP response splitting vulnerabilities by tracing user-controlled input into response headers, analyzing newline and control character filtering, and generating severity-rated reports with proof-of-concept payloads and remediation advice.
A PHP security logging and monitoring audit skill that identifies missing security event logs, sensitive data written to logs, log injection/forgery risks, and alert pipeline gaps, then outputs exploitability ratings and remediation guidance.
Analyzes PHP web project source code to extract all HTTP route endpoints and request parameter structures, generating security testing request templates in Burp/Repeater style. Supports Laravel, Symfony, Slim, WordPress, and plain PHP.
A PHP configuration security audit skill that detects CORS misconfigurations, error and debug information exposure, missing security headers, and dangerous runtime settings, providing severity ratings and remediation guidance.
A PHP source code audit skill that identifies open redirect vulnerabilities by tracing user-controllable redirect destinations through header Location calls and redirect functions, analyzing validation and allowlists, and outputting severity ratings with PoC and remediation guidance.