utkusen/sast-skills

1

sast-rce Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous …

utkusen/sast-skills

86

2

sast-xss Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM…

utkusen/sast-skills

64

3

sast-pathtraversal Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with…

utkusen/sast-skills

62

4

sast-analysis Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech sta…

utkusen/sast-skills

60

5

sast-graphql Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and…

utkusen/sast-skills

58

6

sast-sqli Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction …

utkusen/sast-skills

58

7

sast-fileupload Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload si…

utkusen/sast-skills

57

8

sast-idor Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (fin…

utkusen/sast-skills

57

9

sast-businesslogic Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis an…

utkusen/sast-skills

56

10

sast-missingauth Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-pha…

utkusen/sast-skills

56

11

sast-xxe Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing …

utkusen/sast-skills

55

12

sast-jwt Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issu…

utkusen/sast-skills

54

13

sast-report Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and co…

utkusen/sast-skills

54

14

sast-hardcodedsecrets Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code …

utkusen/sast-skills

53

15

sast-ssrf Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find out…

utkusen/sast-skills

53

16

sast-ssti Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find …

utkusen/sast-skills

53