Vulnerability Scanner FAQs

Question 1

What is the 'Assume Breach' mindset used by the skill?

Accepted Answer

The 'Assume Breach' principle guides the AI to design and audit systems as if an attacker has already gained internal access, focusing on containment and zero-trust verification.

Question 2

Does it support cloud-native security checks?

Accepted Answer

Yes, the skill includes methodology for auditing Cloud IAM least privilege, public storage bucket exposure, and network security group configurations.

Question 3

How does the skill prioritize identified risks?

Accepted Answer

It uses a decision matrix combining CVSS (Base Severity) and EPSS (Exploit Likelihood) scores alongside business context to categorize risks from Critical to Low.

Question 4

Can it detect leaked API keys and secrets?

Accepted Answer

Yes, it includes specialized pattern analysis for high-entropy strings, API keys, JWTs, and cloud-specific credentials for AWS, Azure, and GCP.

Question 5

What security standards does this skill follow?

Accepted Answer

The skill is specifically aligned with the OWASP Top 10:2025 standards, including modern focus areas like Supply Chain Security (A03) and Exceptional Conditions (A10).

Vulnerability Scanner

Key Features

Use Cases

Vulnerability Scanner

Key Features

Use Cases