security-audit

分类: 测试与安全 | 上传者: netresearch | 下载: 0 | 版本: v1.0（最新）

在进行安全评估、OWASP/CWE 审核、CVSS 评分、审核 PHP/TYPO3 项目是否存在漏洞、扫描依赖项或审查代码是否存在安全问题时使用。

更新日志: Source: GitHub https://github.com/netresearch/security-audit-skill

目录结构

当前层级: 根目录

📁 evals/
- 📄 evals.json 788 B
📁 references/
- 📄 api-key-encryption.md 7.3 KB
- 📄 authentication-patterns.md 35.0 KB
- 📄 automated-scanning.md 9.3 KB
- 📄 ci-security-pipeline.md 18.5 KB
- 📄 cryptography-guide.md 33.4 KB
- 📄 cve-patterns.md 43.8 KB
- 📄 cvss-scoring.md 10.1 KB
- 📄 cwe-top25.md 15.9 KB
- 📄 deserialization-prevention.md 19.7 KB
- 📄 error-message-sanitization.md 10.3 KB
- 📄 file-upload-security.md 36.7 KB
- 📄 framework-security.md 40.1 KB
- 📄 input-validation.md 25.2 KB
- 📄 modern-attacks.md 38.2 KB
- 📄 owasp-top10.md 7.6 KB
- 📄 path-traversal-prevention.md 24.5 KB
- 📄 php-security-features.md 21.5 KB
- 📄 security-headers.md 25.5 KB
- 📄 security-logging.md 35.8 KB
- 📄 supply-chain-incident-response.md 12.9 KB
- 📄 supply-chain-security.md 21.1 KB
- 📄 xxe-prevention.md 10.2 KB
📁 scripts/
- 📄 github-security-audit.sh 9.7 KB
- 📄 security-audit.sh 15.5 KB
📄 checkpoints.yaml 55.1 KB
📄 SKILL.md 4.1 KB

SKILL.md

---
name: security-audit
description: "Use when conducting security assessments, OWASP/CWE audits, CVSS scoring, auditing PHP/TYPO3 projects for vulnerabilities, scanning dependencies, or reviewing code for security concerns."
license: "(MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0"
compatibility: "Requires grep, jq, gh CLI."
metadata:
  author: Netresearch DTT GmbH
  version: "2.4.0"
  repository: https://github.com/netresearch/security-audit-skill
allowed-tools: Bash(grep:*) Bash(jq:*) Bash(gh:*) Read Glob Grep
---

# Security Audit Skill

Security audit patterns (OWASP Top 10, CWE Top 25 2025, CVSS v4.0) and GitHub project security checks for any project. Deep automated PHP/TYPO3 code scanning with 80+ checkpoints and 19 reference guides.

## Expertise Areas

- **Vulnerabilities**: XXE, SQL injection, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, type juggling, SSTI, JWT flaws
- **Risk Scoring**: CVSS v3.1 and v4.0 methodology
- **Secure Coding**: Input validation, output encoding, cryptography, session management, authentication
- **Standards**: OWASP Top 10, CWE Top 25, OWASP ASVS, Proactive Controls
- **Infrastructure**: CSP compliance, lock handling, image processing security, error suppression, error message sanitization

## Reference Files

- **Core**: `owasp-top10.md`, `cwe-top25.md`, `xxe-prevention.md`, `cvss-scoring.md`, `api-key-encryption.md`
- **Vulnerability Prevention**: `deserialization-prevention.md`, `path-traversal-prevention.md`, `file-upload-security.md`, `input-validation.md`
- **Error Handling**: `error-message-sanitization.md` (API key redaction, exception hierarchy, frontend exposure)
- **Secure Architecture**: `authentication-patterns.md`, `security-headers.md`, `security-logging.md`, `cryptography-guide.md`
- **Framework Security**: `framework-security.md` (TYPO3, Symfony, Laravel)
- **Modern Threats**: `modern-attacks.md`, `cve-patterns.md`, `php-security-features.md`
- **DevSecOps**: `ci-security-pipeline.md`, `supply-chain-security.md`, `automated-scanning.md`
- **Incident Response**: `supply-chain-incident-response.md` (detection, triage, remediation playbooks for GitHub Actions supply chain compromises)

All files located in `references/`.

## Quick Patterns

**XML parsing (prevent XXE):**
```php
$doc->loadXML($input, LIBXML_NONET);
```

**SQL (prevent injection):**
```php
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);
```

**Output (prevent XSS):**
```php
echo htmlspecialchars($input, ENT_QUOTES | ENT_HTML5, 'UTF-8');
```

**API keys (encrypt at rest):**
```php
$nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
$encrypted = 'enc:' . base64_encode($nonce . sodium_crypto_secretbox($apiKey, $nonce, $key));
```

**Password hashing:**
```php
$hash = password_hash($password, PASSWORD_ARGON2ID);
```

For automated scanning tools (semgrep, trivy, gitleaks), see `references/automated-scanning.md`.

## Security Checklist

- [ ] `semgrep --config auto` passes with no high-severity findings
- [ ] `trivy fs --severity HIGH,CRITICAL` reports no unpatched CVEs
- [ ] `gitleaks detect` finds no leaked secrets
- [ ] bcrypt/Argon2 for passwords, CSRF tokens on state changes
- [ ] All input validated server-side, parameterized SQL
- [ ] XML external entities disabled (LIBXML_NONET only)
- [ ] Context-appropriate output encoding, CSP configured
- [ ] API keys encrypted at rest (sodium_crypto_secretbox)
- [ ] Exception messages sanitized (no API keys, paths, or SQL in responses)
- [ ] Consistent exception hierarchy across provider abstraction layers
- [ ] TLS 1.2+, secrets not in VCS, audit logging
- [ ] No unserialize() with user input, use json_decode()
- [ ] File uploads validated, renamed, stored outside web root
- [ ] Security headers: HSTS, CSP, X-Content-Type-Options
- [ ] Dependencies scanned (composer audit), Dependabot enabled

## Verification

```bash
# PHP project security audit
./scripts/security-audit.sh /path/to/project

# GitHub repository security audit
./scripts/github-security-audit.sh owner/repo
```

---

> **Contributing:** https://github.com/netresearch/security-audit-skill

登录后下载/点赞/收藏 ❤ 7 | ★ 0

security-audit

目录结构

SKILL.md

举报内容

提示