**194 AI 코딩 에이전트에 대한 도구 -agnostic 보안 테스트 기술 : 흰색 상자 버그 사냥, AI 시약 및 LLM red-teaming, 코드-interpreter sandbox 및 Model-inference-endpoint 남용, 서버 측 주입 및 탈선화 SQL, NoSQL, LDAP, expression-language 및 object 스트림, 클라우드의 깊이 ID, 비밀 및 KMS 신뢰, 인프라 코드 및 컨테이너 / Kubernetes and host workload trust, 네트워크, 와이어-protocol, and multiplexing trust HTTP / 2, gRPC, 메시지 브로커 및 상호 TLS, federation 및 토큰 신뢰 SAML, OIDC, OAuth 및 JWT, SCIM 및 JIT의 엔터프라이즈 정체성 수명주기 프로비저닝, 디렉토리 동기화, MFA 및 키 수명주기, Kerberos delegation, 및 파손 유리 및 기계 ID 신뢰, 계정 회복 및 지불 및 상업 무결성, 클라이언트 앱은 브라우저와 편집기 확장 및 Electron을 통해 표면을 신뢰합니다. 모바일 앱 보안, Smart-contract 및 DeFi 리뷰 EVM 및 웹 3 account-abstraction, 크로스 체인 브리지, MEV, 시그니처 재생 및 지갑 배수기 신뢰, 브라우저 제3자 기술 및 clickjacking 신뢰, IoT 및 Edge BLE 및 펌웨어 업데이트 신뢰, 기술 및 공급망 신뢰, API 및 객체 사용

security-agent-skills

194 tool-agnostic security-testing skills for AI coding agents: white-box bug hunting, AI-agent and LLM red-teaming, code-interpreter sandbox and model-inference-endpoint abuse, server-side injection and deserialization depth across SQL, NoSQL, LDAP, expression-language, and object streams, cloud identity, secrets, and KMS trust, infrastructure-as-code and container/Kubernetes and host workload trust, network, wire-protocol, and multiplexing trust across HTTP/2, gRPC, message brokers, and mutual TLS, federation and token trust across SAML, OIDC, OAuth, and JWT, enterprise identity lifecycle across SCIM and JIT provisioning, directory sync, MFA and key lifecycle, Kerberos delegation, and break-glass and machine-identity trust, account-recovery and payment-and-commerce integrity, client-app trust surfaces across browser and editor extensions and Electron, mobile app security, smart-contract and DeFi review across EVM and Move plus web3 account-abstraction, cross-chain bridge, MEV, signature-replay, and wallet-drainer trust, browser third-party-script and clickjacking trust, IoT and edge BLE and firmware-update trust, skill and supply-chain trust, API and object-authorization depth, firmware and embedded-software trust, web and transport trust boundaries, authentication and session depth, rate-limiting and multi-tenant isolation, file-upload and resource-exhaustion depth, the classic web-attack classes across XSS, template and command injection, XXE, XPath, path traversal, formula and include injection, HTTP parameter pollution, and CRLF, the web trust-boundary classes across open redirect, CSRF, host-header and URL-parsing trust, cache deception, server-side rendering and SVG abuse, Unicode canonicalization bypass, and postMessage trust, Windows and Active Directory privilege escalation and domain identity abuse across services, DLL search order, tokens and privileges, ADCS, directory ACLs, NTLM coercion and relay, group policy, and credentials, native iOS and Android app security across the keychain and data protection, WebView bridges, TLS pinning, biometrics, app groups, app bundles, mobile backends, intent redirection, tapjacking, and tamper resistance, defensive detection and logging, and appsec depth.

Agent skills that encode security-testing methodology: the reasoning, ordering, and adjudication discipline behind real black-box and white-box testing, written as portable Claude Code skills.

The bet is that a skill’s value is judgment, not a script. Enumerate the whole