ZeroDayShield: Universal Supply Chain Guard

Traditional Web Application Firewalls (WAF) and dependency scanners often fail to catch sophisticated supply chain attacks that use encoding bypasses or post-exploitation persistence. If you are running enterprise software like PeopleSoft or WebLogic, standard perimeter defense is not enough to stop active zero-day exploitation.

This skill provides a defense-in-depth layer that validates deployment manifests and access logs against the CISA KEV catalog and known threat actor behaviors. It identifies unpatched critical vulnerabilities, detects obfuscated WAF-bypass attempts, and hunts for existing post-exploitation artifacts like web shells or unauthorized agents before they reach production.

What it does

• Vulnerability scanning maps your pom.xml, package.json, and Dockerfiles against the CISA KEV catalog and vendor advisories.
• WAF-bypass detection analyzes access logs for percent-encoded, double-encoded, or mixed-case path variants that evade literal firewall rules.
• Artifact hunting searches for specific indicators of compromise such as x.jsp web shells, Neo-reGeorg tunneling tools, and MeshAgent configurations.
• Risk attribution maps every finding to specific MITRE ATT&CK techniques like T1190 (Exploit Public-Facing Application).
• Automated gating produces structured JSON reports with BREACH, WARNING, or CLEAR verdicts for CI/CD integration.

How it works

1. Provide the agent with your dependency manifests, application server access logs, and current software version metadata.
2. The skill cross-references your stack against the latest zero-day intelligence and known-vulnerable version lists.
3. It performs a pattern-match scan on logs to identify successful bypass attempts and local filesystem paths for post-exploitation tools.
4. It generates a compliance report with concrete remediation steps for identified vulnerabilities.

Frameworks & tools

Works with any project using common package managers (Maven, NPM, Gradle, Pip) and application servers like Oracle WebLogic, Apache, or Nginx. Integrated easily with GitHub Actions, Claude Code, and Cursor.

Why this beats prompting it yourself

Manual prompting lacks the specific, hardcoded database of zero-day indicators and encoding bypass patterns required for a high-fidelity audit. This skill encodes technical knowledge of specific attack chains (like CVE-2026-35273) that a general LLM would miss without explicit security context.

Use cases

• Auditing enterprise ERP and HR platforms before production deployment.
• Verifying supply chain integrity after a CISA KEV catalog update.
• Performing quarterly vulnerability management cycles on self-hosted infrastructure.
• Detecting active exploitation attempts hidden by URL encoding in web logs.

Known limitations

Requires access to raw application server logs for bypass detection. Does not provide legal compliance advice or automated patching.