「vulnerability」の検索結果

This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Build a vulnerability exception and risk acceptance tracking system covering approval workflows, compensating controls documentation, and automatic expiration for vulnerabilities that miss SLA remediation timelines. Use when standing up a governance process for risk acceptance and exception approvals to support PCI DSS, SOC 2, or NIST CSF compliance.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.

日本語の概要は準備中です。原文の説明を表示しています。

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

日本語の概要は準備中です。原文の説明を表示しています。

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.

日本語の概要は準備中です。原文の説明を表示しています。

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

日本語の概要は準備中です。原文の説明を表示しています。

Write a vulnerability report. Use when the user says "vulnerability report", "vuln report", "security finding", "write up this finding", "pentest finding", "bug bounty report", "security disclosure", "CVE writeup", "document this vulnerability", "how to report a security issue", or needs to formally document a security vulnerability with evidence, impact, and remediation guidance - even if they don't explicitly say "report".

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.

日本語の概要は準備中です。原文の説明を表示しています。

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.

日本語の概要は準備中です。原文の説明を表示しています。

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.

日本語の概要は準備中です。原文の説明を表示しています。

Build a vulnerability exception and risk acceptance tracking system with approval workflows, compensating controls documentation, and expiration management.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.

日本語の概要は準備中です。原文の説明を表示しています。

Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.

日本語の概要は準備中です。原文の説明を表示しています。

Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

日本語の概要は準備中です。原文の説明を表示しています。

End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for this CVE", "how do I backport this", or "what's the right fix for this bug class" - even when the user never says the word "reproduce". Reach for it on vague asks like "help me understand this security advisory", "I want to write about this incident", or "can we test whether we were vulnerable" when a disclosed vulnerability is in play. This skill only handles ALREADY-PATCHED, publicly disclosed issues and refuses zero-day discovery, live targets, and weaponization.

日本語の概要は準備中です。原文の説明を表示しています。

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.

日本語の概要は準備中です。原文の説明を表示しています。

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".

日本語の概要は準備中です。原文の説明を表示しています。

Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting

日本語の概要は準備中です。原文の説明を表示しています。

Conducts HIPAA risk analysis per 45 CFR §164.308(a)(1) following OCR guidance methodology. Covers threat identification, vulnerability assessment, likelihood and impact determination, risk scoring, and mitigation planning for electronic protected health information. Keywords: HIPAA risk analysis, OCR guidance, threat assessment, vulnerability, risk management, ePHI.

日本語の概要は準備中です。原文の説明を表示しています。

Audit existing vulnerability management — find SLA gaps, missing tiers, and process failures. Use when asked to "audit our vulnerability management", "find patch SLA gaps", or "are we patching fast enough".

日本語の概要は準備中です。原文の説明を表示しています。