Security
4,732 results
- Power Automate Desktop AssessmentMicrosoftOfficialAssess Power Automate Desktop and hybrid cloud/desktop automation projects for maintainability, reliability, security, performance, troubleshooting readiness, scaling, and governance using current Microsoft guidance and evidence-based review practices.
- Power Automate DocumentationMicrosoftOfficialTrigger whenever the user uploads or references a Power Automate solution `.zip` and asks about references, dependencies on other flows, or related questions — phrasing like "document this flow", "what does this flow read/write/touch", "map the connection references", "audit this solution", or "which flows call which".
- Root Cause AnalysisMicrosoftOfficialUse this skill whenever the user asks to diagnose why something failed, find the root cause of an incident, conduct a post-mortem, analyze a problem or defect, distinguish symptoms from causes, or apply 5 Whys or Fishbone analysis.
- Wcag Power PlatformMicrosoftOfficialEnsure web apps, HTML pages, and Power Platform components meet WCAG 2.1 accessibility guidelines. Use this skill WHENEVER building, reviewing, or refactoring any web UI or Power Platform artifact — standalone HTML/CSS/JS pages, websites and single-page apps, React/web artifacts, PCF (PowerApps Component Framework) controls, HTML/JS web resources, model-driven apps and forms, canvas apps, or…
- Unsafe Rust Review ExperimentalGoogleOfficialAuthor, document, review, audit, or redesign unsafe Rust with proof-grade rigor. Use for unsafe blocks and functions, unsafe traits and impls, raw pointers, FFI, inline assembly, intrinsics, layout or validity reasoning, concurrency and atomics, SIMD and target features, allocators, invariant-bearing fields, safety comments or `# Safety` documentation, soundness reviews, TCB audits, generated…
- Analyze Canvas PerformanceMicrosoftOfficialAnalyze and audit a Power Apps canvas app. USE WHEN the user wants to analyze, profile, audit, review, diagnose, or improve a Canvas App or pa.yaml files. USE FOR: slow apps, long load times, delegation warnings, N+1 database calls, excessive collections, ForAll optimization, OnStart overload, Named Formulas, Concurrent execution, Explicit Column Selection, DelayOutput on text inputs…
- Eval Generator Code AppMicrosoftOfficialGenerate a two-layer eval suite (presence checks + static security analysis) for a Power Apps Code App. Code Apps use @microsoft/power-apps SDK with generated service classes in src/generated/services/ — NOT @microsoft/powerapps-component-framework or context.webAPI.*. BRD is optional — if absent, features are derived from a code review of the project.
- Eval Generator Gen PagesMicrosoftOfficialGenerate a three-layer eval suite (presence checks + unit tests + security analysis) for Power Apps Generative Pages in Model-Driven Apps. Generative pages are single-file React/TypeScript components using Fluent UI V9 and the dataApi prop for Dataverse operations — NOT Code Apps, NOT PCF components.
- Powercat OverflowMicrosoftOfficialReviews every Power Automate cloud flow inside a Power Platform solution (.zip) against Microsoft's coding guidelines and produces a [SolutionName].findings.json next to the uploaded solution, then opens the hosted PowerCAT-Overflow viewer at https://microsoft.github.io/power-cat-skills/PowerCAT-Overflow.html and uploads both files so the user can explore the results.
- Powercat OverpageMicrosoftOfficialReviews the Power Pages site(s) inside a Power Platform solution .zip against best practices across Security, Performance, Accessibility, Maintainability, Architecture and Reliability — by reading the pages, web templates, custom JS/CSS, settings and table permissions and reasoning about them.
- Powercat Pp Architecture AdvisorMicrosoftOfficialDesign a Power Platform solution through adaptive discovery and a Power CAT-style architecture review. Recommend a composed solution across Canvas, model-driven apps, Power Pages, code apps, managed apps, Copilot Studio, Dataverse, Power Automate, and Power BI. Explain fit, tradeoffs, security, compliance, ALM, implementation, learning, certifications, and curated build resources.
- Vercel DeepsecSentryOfficialDetects broad web application security vulnerabilities using the Vercel DeepSec benchmark prompt. Use when benchmarking security review coverage or running an open-ended appsec scan for auth bypass, missing auth, XSS, RCE, SQL injection, SSRF, path traversal, secrets, weak crypto, unsafe redirects, webhook verification, Next.js Server Actions, Lua/OpenResty, Go, cache poisoning, or header trust…
- Wrdn Dos ReviewSentryOfficialFinds availability / denial-of-service bugs reachable from untrusted input — unbounded allocation, uncontrolled recursion, non-terminating loops, decompression bombs, panic/resource-leak, super-linear output amplification, algorithmic-complexity / ReDoS catastrophic regex backtracking, and bounds that are present but ineffective (wrong dimension, applied too late, under-counting cost, or…
- Wrdn Gha WorkflowsSentryOfficialDetects exploitable GitHub Actions workflow vulnerabilities, including pull_request_target pwn requests, unsafe PR checkout, expression injection in run steps and actions/github-script blocks, workflow_dispatch and workflow_call input command injection, comment- and discussion-triggered commands, TOCTOU between approval and checkout, secret exposure, broad permissions, reusable workflows that…
- Security Alert ReviewMicrosoftOfficialList and review Advanced Security alerts for an Azure DevOps repository. Shows dependency vulnerabilities, secret exposure, and code scanning findings with filtering by severity, state, and alert type.
- Auth0Auth0OfficialUse when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes and endpoints, MFA, passwordless passkey login (WebAuthn), SSO, Organizations, RBAC, custom domains, Universal Portals for hosted account and organization self-service, or Universal Login branding.
- Cve Known VulnerabilitiesMicrosoftOfficialDetect known CVEs in Maven, NuGet, or npm dependencies using the GitHub Security Advisories API
- Cve RemediationMicrosoftOfficialScan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest.
- Cwe Code QualityMicrosoftOfficialAssess codebase for CWE code quality vulnerabilities (CWE-130, CWE-456, CWE-457, CWE-477, CWE-570, CWE-571, CWE-606, CWE-665, CWE-681, CWE-682, CWE-772, CWE-775, CWE-783, CWE-789, CWE-835, CWE-1057)
- Cwe Concurrency SynchronizationMicrosoftOfficialAssess codebase for CWE concurrency & synchronization vulnerabilities (CWE-543, CWE-567, CWE-662, CWE-667, CWE-820, CWE-821)
- Cwe Credentials SecretsMicrosoftOfficialAssess codebase for CWE credentials & secrets vulnerabilities (CWE-259, CWE-321, CWE-732, CWE-778, CWE-798)
- Cwe File Path SecurityMicrosoftOfficialAssess codebase for CWE file & path security vulnerabilities (CWE-22, CWE-23, CWE-36, CWE-434, CWE-611)
- Cwe Injection AttacksMicrosoftOfficialAssess codebase for CWE injection attacks vulnerabilities (CWE-77, CWE-78, CWE-79, CWE-88, CWE-89, CWE-90, CWE-91, CWE-99, CWE-502, CWE-564, CWE-643, CWE-652)
- Cwe Memory SafetyMicrosoftOfficialAssess codebase for CWE memory safety vulnerabilities (CWE-119, CWE-120, CWE-123, CWE-125, CWE-415, CWE-416, CWE-672, CWE-786, CWE-787, CWE-788, CWE-805, CWE-822, CWE-823, CWE-824, CWE-825)