AI TOOLS RADAR
Tous les Skills / NETRESEARCH
netresearch/security-audit-skill

security-audit

Use when conducting security assessments — OWASP Top 10 / API / LLM, CWE Top 25, CVSS scoring — auditing PHP/TYPO3, APIs, frontend, Terraform/K8s/Docker IaC, AWS cloud, AI agent configs, or scanning dependencies.

Voir la source

Mode d’emploi

  1. Copiez la commande et examinez le paquet avant de l’installer dans votre environnement agent.
  2. Consultez le document original pour les outils, identifiants et environnements requis.
  3. Décrivez les entrées et le livrable souhaité ; comparez la sortie aux sources.
npx skills add https://github.com/netresearch/security-audit-skill --skill security-audit

Avant de commencer

  • L’installation n’inclut ni abonnement au modèle, ni quota API, ni accès aux fichiers.
  • Étoiles et installations reflètent l’activité, pas un test indépendant de qualité ou de sécurité.
Document Skill original

Rendu depuis le dépôt source en conservant titres, exemples, code, tableaux, liens et images.

Security Audit Skill

Security audit patterns (OWASP Top 10, LLM Top 10 2025, CWE Top 25 2025, CVSS v4.0), cloud/IaC, GitHub security. 80+ PHP/TYPO3 checkpoints (v14.3 LTS in typo3-security.md).

Expertise Areas

  • Vulnerabilities: XXE, SQLi, XSS, CSRF, command injection, path traversal, file upload, deserialization, SSRF, SSTI, JWT, type juggling
  • Standards: OWASP Top 10 / API / LLM (2025), CWE Top 25, CVSS v3.1/v4.0, OWASP ASVS
  • Cloud & IaC: AWS; Terraform, Kubernetes, Docker, Helm
  • API & Frontend: REST/GraphQL authZ, rate limits, mass assignment, CSP, DOM-XSS
  • AI Agents: SKILL.md/AGENTS.md/CLAUDE.md/mcp.json/hooks.json audit; prompt injection; excessive agency

Reference Files (in references/, .md implied)

  • Core: owasp-top10, cwe-top25, xxe-prevention, cvss-scoring, api-key-encryption
  • Prevention: deserialization-prevention, path-traversal-prevention, file-upload-security, input-validation, error-message-sanitization, ssh-forced-command-hardening
  • Architecture: authentication-patterns, security-headers, security-logging, cryptography-guide, security-invariants, indistinguishability-defences
  • Language features (*-security-features): php, python, javascript-typescript, nodejs, go
  • Frameworks (*-security): typo3, typo3-fluid, typo3-typoscript, symfony, react, vue
  • Cloud & IaC: aws-security, iac-security
  • API & Frontend: api-security, frontend-security
  • AI Agent: llm-security (OWASP LLM Top 10 2025)
  • Threats: modern-attacks, cve-patterns
  • DevSecOps: ci-security-pipeline, supply-chain-security, automated-scanning, gha-security, git-history-secrets
  • Incident: supply-chain-incident-response

Security Checklist

  • [ ] semgrep/opengrep, trivy fs --severity HIGH,CRITICAL, gitleaks clean
  • [ ] bcrypt/Argon2 passwords, CSRF on state changes, TLS 1.2+
  • [ ] Server-side input validation; parameterized SQL; XML entities off
  • [ ] Output encoding + CSP; no unserialize() on user input
  • [ ] API keys encrypted; exception messages sanitized
  • [ ] Secrets out of VCS; audit logging on
  • [ ] Uploads validated, renamed, outside web root
  • [ ] Headers HSTS + X-Content-Type-Options; dependencies scanned

GitHub Actions Security

  • NEVER interpolate ${{ inputs.* }} / ${{ github.event.* }} in run: — use env:
  • Dependency triage: upgrade > override > dismiss. Full patterns: references/gha-security.md.

Verification

bash
./scripts/security-audit-dispatcher.sh /path/to/project  # auto-detect stack
./scripts/security-audit.sh /path/to/project             # PHP-only
./scripts/github-security-audit.sh owner/repo            # GH repo

Dispatcher detects the stack from indicator files and runs matching scripts/scanners/*.sh (13 ecosystems; see references/ index).

Contributing: https://github.com/netresearch/security-audit-skill