137 tagged appsec, measured the same way as everything else here.
Browse within: owasp 46ai-security 31agentic-appsec 23agentic-workflows 23container-scanning 23endor-labs 23malware-response 23owasp-juice-shop 23owasp-llm 23owasp-llm-top-10 23CVE 21fuzzing 21red-team 18github-copilot 14
Agent
Plans and applies dependency-vulnerability fixes using Endor SCA findings, VersionUpgrade and Upgrade Impact Analysis evidence, deterministic risk decisions, and local validation. It separates low-risk changes from upgrades requiring deeper compatibility review and requires explicit approval before editing files…
Agent
Diagnoses Endor setup, authentication, integration, scanning, dependency-resolution, container, reachability, policy, and workflow problems. It gathers the smallest useful set of read-only evidence needed to identify the likely root cause and recommend the lowest-friction repair without modifying Endor…
Agent
Generated for Cursor Python SDK automation.
Agent
Detection-engineering agent — writes Sigma rules, translates to SPL/KQL/EQL, validates via test harness (atomic-red-team / MITRE Caldera / lab replay), with ATT&CK coverage mapping and false-positive discipline. Delivers ready-to-deploy rules plus test evidence per rule.
Agent
Attack-surface reconnaissance agent — subdomain enumeration, passive OSINT (Shodan/Censys/crt.sh), port scanning (nmap/masscan/naabu), tech fingerprinting (httpx/wappalyzer), and asset inventory. Produces a scope-mapped surface report for downstream exploit-chain and web-exploit-triage work.
Agent
STRIDE and LINDDUN threat-modeling agent for a service, feature or integration. Builds a DFD, enumerates threats per element, ranks mitigations and flags residual risk.
Agent
Locates candidate sites for one vulnerability class across a codebase and records them for later verification. Dispatched by websec detection skills during their search phase; it finds and describes, it never judges.
Agent
Traces a small set of candidate sites end to end and classifies each against a vulnerability class with evidence. Dispatched by websec detection skills during their verification phase; it decides, and it must show why.
Agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.
Agent
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 3.1 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.
Agent
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
Agent
An agent that turns detected vulnerabilities into concrete attack scenarios by analysing how weaknesses can be chained together.
Agent
A static code-analysis agent that looks for Cross-Site Request Forgery (CSRF), an attack where a victim’s browser is tricked into sending an unwanted request to a site where they are signed in.
Agent
A security-checking agent for WordPress, the software used to build many websites, that looks for unsafe coding patterns in the source code.
Agent
Read-only OSWE white-box security analyzer for a single code partition. Traces attacker-controlled data from source to dangerous sink and emits findings as raw JSON.
Agent
Read-only independent verifier that re-derives OSWE findings and exploit chains from source and returns accept/downgrade/reject verdicts as raw JSON.