구본승
Community@bs-koo
SQIsoft web application security suite combining Semgrep static detection and dynamic exploit confirmation for Spring Boot and JSP/Servlet stacks, plus Korean SI documentation generation.
Agent Skills by 구본승
Showing 46 vetted skills indexed across 3 GitHub repositories.
bs-kooexploiting-xss-vulnerabilities
Confirms XSS exploitability by injecting marker payloads and verifying browser execution via Playwright.
bs-koodetecting-csrf-vulnerabilities
Detects CSRF vulnerabilities in Spring Boot and JSP/Servlet applications using Semgrep rules and AI context verification.
bs-kooexploiting-broken-access-control
Confirms BFLA and IDOR vulnerabilities by firing authenticated HTTP requests against staging targets.
bs-kooexploiting-sql-injection
Fires SQL injection payloads against authorized staging targets to confirm exploitability of static scan findings.
bs-koodetecting-broken-access-control
Detects IDOR, BFLA, and forced browsing vulnerabilities in Spring Boot and JSP web applications.
bs-kooexploiting-ssrf-and-open-redirect
Confirms SSRF and open redirect vulnerabilities via OOB canary callbacks and Location header analysis.
bs-koodetecting-path-traversal
Detects path traversal vulnerabilities in Spring Boot and JSP web application source code.
bs-koodetecting-file-upload-vulnerabilities
Detects unrestricted file upload vulnerabilities in Spring Boot and JSP/Servlet applications.
bs-koodetecting-sql-injection
Detect SQL Injection vulnerabilities in Spring Boot and JSP/Servlet codebases using Semgrep rules and AI context verification.
bs-koodetecting-sensitive-data-exposure
Detect hardcoded secrets, PII logging, and sensitive data exposure in Spring and JSP codebases.
bs-kooexploiting-with-burp
Validates access control, session, SSRF, and path traversal flaws via Burp Suite MCP.
bs-kooexploiting-auth-session
Confirms JWT, session, and cookie vulnerabilities by firing tampered tokens at staging endpoints.
bs-kooauditing-web-application-security
Orchestrates static and dynamic security audits of Spring and JSP web applications into unified reports.
bs-kooexploiting-path-traversal-upload
Confirms path traversal and unsafe file upload vulnerabilities via dynamic payload testing against staging targets.
bs-koodetecting-ssrf-and-open-redirect
Detect SSRF and open redirect vulnerabilities in Spring and JSP web application source code.
bs-koodetecting-auth-session-weaknesses
Detect authentication, session, and JWT vulnerabilities in Spring Boot and JSP web applications.
bs-koodetecting-xss-vulnerabilities
Detect reflected, stored, and DOM XSS vulnerabilities in Spring, JSP, and Vue codebases.
bs-koodetect-existing-artifact
Detect existing artifact files in a project folder and prompt handling choices.
bs-kooload-project-profile
Detect and load active project profiles from profile.json to initialize context.
bs-koodetect-alternatives
Detect and group alternative designs from RFP and requirements documents.
bs-kooaudit-response
Classify audit findings and generate remediation documents with evidence checklists.
bs-kooscan-source-index
Scan source trees incrementally to generate a cacheable source-index.json.
bs-kooreverse-scan-source
Scan source code projects to reverse-engineer DE-05 program definitions.
bs-kooextract-requirements
Extract functional and non-functional requirements from RFPs into AN-02 documents.
Frequently Asked Questions About 구본승
FAQPage SchemaWhat tasks can I perform with bs-koo's security skills?▼
You can statically detect nine vulnerability classes (SQLi, XSS, CSRF, broken access control, path traversal, file upload, SSRF, auth/session, sensitive data exposure) in Spring Boot and JSP/Servlet code, then dynamically confirm real exploitability with payload injection, and generate a unified audit report.
Who are these skills designed for?▼
They target authorized internal penetration testers and security engineers at SQIsoft working on Spring Boot (modern) or JSP/Servlet (legacy) web applications. A separate skill set serves Korean public SI project managers generating requirements, design, test, and traceability documents.
How does the detection-to-exploitation workflow run in practice?▼
Detection skills auto-identify the project stack, run stack-specific Semgrep rules, then use contextual analysis to filter false positives. Exploitation skills take the candidate URLs and parameters, pass a mandatory fail-closed scope_guard limited to local/staging, and fire non-destructive payloads to confirm findings.
Are these skills open source and what do they cost?▼
No. All 17 new security skills carry a Proprietary license authored by sqisoft-security (version 0.8.2) and are restricted to authorized internal SQIsoft penetration testing. There is no public open-source distribution or free tier indicated in the manifest.
What prerequisites and dependencies are required?▼
Dynamic testing requires a running local or staging target URL. Optional dependencies include sqlmap for SQLi (with a manual PoC fallback), Playwright for browser-based XSS confirmation, and Burp Suite on 127.0.0.1:8080 for hybrid proxy-based verification. Static detection requires Semgrep and project source access.