Web Security (Page 7 of 20)

Defensive playbook for the OWASP Top 10 for LLM Applications (2025), centered on prompt injection (MITRE ATLAS AML.T0051, direct and indirect), RAG retrieval abuse (LLM08), and…

Defensive methodology for open redirect (CWE-601) abuse, where a link on a trusted domain sends the victim off-site via a redirect parameter, used to cloak phishing behind your…

Use when modifying, extending, or regenerating the demo SQLite database that powers Demo Mode and the test fixtures.

OpenPBX TDD 再構築（/denwa）。0→9。legacy parity B（CDR検索・課金明細・同時通話等）は steps 付録 D。 SOC/カプセル化/T-TS(§5.4.1)/T-SEC(ペネトレ)は denwa-architecture-gate + Vitest + prod-check で強制。 層: core / ops /…

Enforce dependency security scanning and SBOM generation. Use when adding dependencies, reviewing package.json, or during security audits.

Persistent storage, SQLite databases, and credential management in Electron apps

Detection and response methodology for API business logic abuse - BOLA / IDOR (OWASP API1:2023), request-rate abuse (API4:2023), and out-of-order workflow attacks against REST and…

Detection and hardening methodology for business logic abuse in web and API applications: workflow/state-machine bypass (skipping payment or approval steps) and pricing abuse…

Detection, hunting, and hardening for insecure deserialization and object-injection gadget chains, where a crafted serialized object sent to a public-facing app becomes remote…

Detection and hardening methodology for HTTP Parameter Pollution (HPP), where an attacker sends the same parameter name more than once (for example role=user&role=admin) so the…

Detection and response for Insecure Direct Object References (IDOR) and broken access control in web apps: horizontal privilege escalation (reading another owner's objects),…

Detection and response for unauthenticated SQL injection in self-hosted Metabase (CVE-2026-72898, CWE-89, CVSS 10.0) via the /api/session/reset_password endpoint, which returns…

Detection and response for HTTP request smuggling (HTTP desync) against front-end/back-end chains: CL.TE, TE.CL, TE.TE and HTTP/2 downgrade variants H2.CL / H2.TE, where a proxy…

Detection and response methodology for Server-Side Request Forgery (SSRF), where a public-facing application is coerced into making attacker-controlled requests, most dangerously…

Detection and hardening methodology for TOCTOU (time-of-check to time-of-use) file race conditions used for local privilege escalation, where an attacker swaps a symlink,…

Detection and hunting methodology for web application race conditions: limit-overrun, multi-endpoint, single-endpoint, and time-sensitive flaws abused with last-byte-sync…

Detection, hunting, and hardening methodology for Cross-Site Scripting (XSS), where attacker-controlled script executes in a victim's browser session on a trusted origin (CWE-79;…

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive

Detects race condition vulnerabilities including TOCTOU, double-checked locking issues, and shared state problems.

Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity

Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction,…

Vérifie un projet contre le OWASP Top 10 et propose des remédiations. À utiliser pour vérifier la conformité OWASP.

Guide pour écrire des requêtes SQL et concevoir des schémas SQLite avec les bonnes pratiques. À utiliser quand l'utilisateur travaille avec SQLite, écrit des requêtes SQL — from…

i-Willink 共通開発標準。スタック非依存の汎用層（TypeScript strict / Conventional Commits / OWASP / テスト方針 / コミット粒度）。各 agent が起動時に preload する。プロジェクト固有の規約は `project-standards` skill 側に書く。

Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS ( — from…

Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS ( — from…

Trigger: web security, XSS mitigation, secure cookies, CSRF, CSP headers, CORS policies. Scope: Frontend and browser-level security boundaries.

Compare checked-in SQL against live MySQL, PostgreSQL, SQLite, or SQL Server schemas and generate a reviewable apply plan before agents touch production databases.

Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets managemen — from…

Django security - CSRF protection, authentication, sessions, login/logout, password handling, middleware, protected views

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

对 jar-analyzer-engine 构建的 SQLite 数据库执行安全审计分析查询。支持方法调用搜索、调用链追踪、Spring 组件分析、字符串搜索、漏洞模式检测等。

OWASP Docker Top 6 vulnerability knowledge base for identifying, assessing, and remediating security risks in containerized Docker environments.

DOMPurify XSS sanitization for HTML content in agent outputs. Strip script tags and event handlers, allowlist-based tag/attribute filtering, sanitize LLM-generated HTML before…

Perform OWASP Top 10 static security audit identifying vulnerabilities in access control, cryptography, injection, configuration, and logging.

Respond fast and safely if your personal information has been exposed or you're being doxxed — contain the spread, protect your safety and accounts, and report it.

Vstupní bod a společný standard pipeline pro řízení kvality dat v libovolné databázi (MySQL, PostgreSQL, SQL Server, Oracle, SQLite, DuckDB) — DQ dimenze, formát zjištění, škála…

Manage database schema with Drizzle ORM and SQLite migrations. Use when adding tables, modifying columns, creating indexes, or running migrations.

Provides comprehensive Drizzle ORM patterns for schema definition, CRUD operations, relations, queries, transactions, and migrations.

Drizzle ORM best practices including schema design with relationships, database migrations, prepared statements for performance, transactions, indexes, Turso SQLite database…

Security and regulatory compliance — OWASP, privacy laws, data protection, web security, i18n. Use when auditing for security/privacy compliance, GDPR/KVKK, or pre-release legal…

Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite s — from…

Publish articles and posts to Dzen.ru (Yandex Zen). Supports text, images, and videos. Requires session cookies and a CSRF token from a logged-in browser session.

Auditoria de segurança, análise de vulnerabilidades OWASP, proteção de dados e hardening

Safely inspect, query, validate, and modify open `.eidos` structured-data files with the agent-first Rust `eidos` CLI.

Build secure desktop applications with Electron 33, Vite, React, and TypeScript. Covers type-safe IPC via contextBridge, OAuth with custom protocol handlers, native module…

Use when the user needs to write, review, or migrate SQL queries in ADVPL/TLPP using BeginSQL/EndSQL blocks and macro expressions (%table%, %xfilial%, %notDel%, %exp%, %Order%)…

EmDash（Cloudflare 発の TypeScript/Astro ベース CMS、WordPress の精神的後継・MIT）のセットアップ・構成・運用スキル。emdash 0.29 基準。新規サイト作成（pnpm create emdash）・既存 Astro への統合・Cloudflare（D1/R2/KV）と Node/SQLite…

Flashcard-based English vocabulary learning with SQLite + SRS. Works with any chat platform when paired with an OpenClaw agent prompt.

Diagnose and fix Laravel environment configuration issues, cache problems, and database connection errors.

Deserialization vulnerability audit skill with gadget chain knowledge for all major languages. Trigger when the user asks to: "audit deserialization", "check for insecure…

Serialization and deserialization security review skill for object mappers, parser pipelines, message formats, and state transfer mechanisms.

Read-only source-vs-target assertion after a data transform or copy — prove every row moved. Compares CSV or SQLite endpoints (--src/--dst as csv: | sqlite::) on…

eve-frontier-data

EVE Frontier data pipelines — killmail ingestion, smart assembly tracking, entity normalization, polling architecture, and SQLite/PostgreSQL storage patterns.

expense

Dodaje fakturę zakupu (koszt) do rejestru SQLite — zapisuje sprzedawcę, NIP, kwoty, kategorię, datę wpływu.

explain-endpoint

Analizuje endpoint Express — wyjaśnia co robi, jakie ma wektory ataku (OWASP), jak zabezpieczyć. Używaj przy nauce nowych endpointów lub security.

exploiting-broken-function-level-authorization

Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding

exploiting-idor-vulnerabilities

Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources

exploiting-insecure-deserialization

Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications

All Security skills →

More in SecurityRed Team (1,734) · Threat Hunting (876) · Identity Access (547) · Network Security (462) · Appsec Tools (423) · Forensics (342) · Compliance (239) · Malware Analysis (227) · Cloud Security (100) · Zero Trust (88) · Crypto Keymgmt (75) · Appsec Build (68) · Incident Response (21) · Ot Ics Security (11)

Categories

• Engineering
• Dev Tools
• Security
• Growth
• Sales
• Content
• Product
• Research
• Advertising
• General

Use cases

• Security audits
• Code review
• Test generation
• DevOps automation
• Data analysis
• SEO research
• Content writing
• Cold outreach
• Social media
• Customer support

Popular tags

• python
• typescript
• javascript
• claude
• llm
• react
• vue
• docker
• github
• aws
• mcp
• agent

Learn

• What is a Claude skill?
• Claude Code MCP servers
• Claude Code plugins
• Claude Code hooks
• Claude Code extensions
• How to write a skill
• SKILL.md frontmatter
• Skills vs MCP servers
• Catalogs compared
• Skill security scan

Site

• Browse all skills
• Arcade — tools & MCP servers
• Arcade comparisons
• Stacks
• Authors
• Stats
• Integrations
• Skill of the day
• What's new
• Top 100
• Best of
• Top 50 (data)
• Install guide
• Manage subscription
• Public API
• Security grading
• Press kit
• About
• Compare skills
• All tags
• All use cases
• Browse by role
• All tutorials