ultrasafe-web-api-attacker
SolidPre-release simulated penetration testing from the OWASP Top 10 / API contract / auth-bypass / SQLi / XSS / SSRF / CSRF / open-redirect / IDOR attacker perspective. Invoke during Ultrasafe ≥3-iteration fan-out when the axis-set includes `usf-web-sast-dast` or `usf-web-infra`, or when a PreToolUse trigger matches a publish-equivalent command (npm publish / pip upload / git push --tags public). Emits `ULTRASAFE_FINDING` A2A intent per finding (Constellation §13.16) with OSCAL-aligned payload + attack-path-graph flat-list candidate. v0.2.x advisory mode — report-only, no publish blocking; blocking promotion deferred to v0.3+.
Install
Quality Score: 81/100
Skill Content
Details
- Author
- SoliEstre
- Repository
- SoliEstre/EstreGenesis
- Created
- 2 months ago
- Last Updated
- today
- Language
- JavaScript
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
ultrasafe-ai-llm-redteam
Pre-release simulated penetration testing from the AI/LLM red-team perspective — direct/indirect prompt injection, model extraction, jailbreak, hallucination-leverage, agentic misalignment, alignment-faking probe. Model-invoked by the Ultrasafe orchestrator (Workflow fan-out, Phase B) during ≥3 iteration pre-release fuzz cycles, or when the publish PreToolUse hook (npm publish / pip upload / git push --tags to public) fires advisory-mode trigger. Emits findings via ULTRASAFE_FINDING A2A intent (Constellation §13.16) with `value.advisory: true` in v0.2.x (report-only, no publish block). Skip for purely local dev runs without LLM-integrated surface.
ultrasafe-social-engineer
Pre-release security testing — simulated penetration from the social-engineering / human-factor attacker perspective. Use when the Ultrasafe orchestrator dispatches Agent 5 of the 8-agent fan-out at iteration N (`usf-social-eng` axis 포함 시), or when a publish-equivalent command triggers the PreToolUse hook and the `social-engineer` role is in the active axis set. Scans for phishing surface (credential prompts, OAuth UX traps), docs leak (README/CHANGELOG/commit messages exposing OPSEC slips, internal hostnames, sample tokens), human-factor exploitation (Cialdini 6 × Hadnagy 9 × FBI 8-elicitation cross-tuple), and A2A inbound Spotlighting bypass attempts. Emits findings via `ULTRASAFE_FINDING` Constellation intent (§13.16) — advisory mode in v0.2.x (report-only, publish 차단 없음). SKIP when iteration ≤ 0 (no baseline) or when axis-set excludes `usf-social-eng`.
ultrasafe-supply-chain-auditor
Pre-release simulated penetration testing from the dependency / SBOM / typosquatting / signing-chain perspective. Invoke as Agent 3 of the Ultrasafe 8-agent fan-out (Ultrasafe.md §15.3) whenever the iteration axis-set includes `usf-supply-chain`, or whenever a release candidate touches dependency manifests (package.json / pyproject.toml / Cargo.toml / go.mod / requirements*.txt / lockfiles / SBOM artifacts / signed-attestation chains). Emits `ULTRASAFE_FINDING` A2A intents (Constellation §13.16, §18.1) with PURL canonical ids, OSV CVE matches, SLSA provenance verdicts, cosign+Rekor attestation chain status, and maintainer-anomaly flags. v0.2.x = advisory mode (report-only, never auto-blocks publish); v0.3+ = blocking gate for deterministic signals only. Maintainer-anomaly findings are always human-gated (Ultrasafe §2.1.3 CT1) regardless of mode.