IgorSasovets
Community@IgorSasovets
Security | Pentester | AI | DevSecOps | Automation engineer
Agent Skills by IgorSasovets
Showing 9 vetted skills indexed across 1 GitHub repositories.
IgorSasovetsopengrep-rule-creator
Generates validated Opengrep YAML security rules from code reconnaissance reports and known-issue registers.
IgorSasovetsopengrep-code-recon
Scans project source code to map tech stack, data flows, and security sinks into a CODE_RECON.md report.
IgorSasovetsopenapi-source-recon
Scans source code to map HTTP routes, auth schemes, and schemas for OpenAPI generation.
IgorSasovetsopenapi-devtools-scan
Extract API endpoints and secrets from a running web application via Chrome DevTools MCP.
IgorSasovetsopenapi-spec-builder
Assembles reconnaissance artifacts into a complete OpenAPI 3.0.3 specification file.
IgorSasovetsiac-threat-model
Builds STRIDE-based threat models for AWS Terraform and CloudFormation infrastructure.
IgorSasovetsiac-audit
Audits Terraform and CloudFormation templates against CIS benchmarks and threat models with CVSS-scored findings.
IgorSasovetsiac-reassess
Validates IaC audit findings by re-verifying evidence and reassessing CVSSv3.1 severity scores.
IgorSasovetszap-review
Extracts and deduplicates OWASP ZAP findings, then verifies each against a live target via Burp Suite.
Frequently Asked Questions About IgorSasovets
FAQPage SchemaWhat tasks can I perform using IgorSasovets's skills?▼
You can map codebases and write Opengrep security rules, extract API endpoints from source or live apps to build OpenAPI 3.0.3 specs, threat-model and audit Terraform/CloudFormation against CIS benchmarks, run AWS Well-Architected reviews, verify ZAP findings via Burp Suite, and trace npm audit exploitability.
Who are these skills designed for?▼
Pentesters, DevSecOps engineers, and security auditors. The pipelines target practitioners performing SAST rule development, IaC security reviews, cloud posture assessments, and manual verification of scanner output against live targets with full HTTP request/response proof-of-concept evidence.
How do the multi-stage pipelines run in practice?▼
Each pipeline runs sequentially: recon stages scan directories with Grep/Glob to produce intermediate artifacts like CODE_RECON.md or PROJECT_MAP.md, then builder or audit stages consume them. Stages support interactive interview, autonomous batch, and tailored single-item modes with operator approval.
What prerequisites and dependencies are required?▼
IaC audits need PROJECT_MAP.md from Stage 1; Well-Architected reviews require SecurityAudit and ReadOnlyAccess IAM policies; live app scanning needs chrome-devtools-mcp and a target URL; ZAP verification uses the Burp Suite MCP server with curl fallback; Opengrep validation uses the opengrep binary when available.
How are false positives and severity scores handled?▼
The iac-reassess stage re-reads cited template lines to confirm each finding, reassesses CVSSv3.1 scores with environmental context, and rejects issues lacking a practical exploitation path. ZAP and npm audit skills similarly verify findings against live targets or trace source-code call chains for exploitability.