القائمة
OWASP 十大漏洞原理、影响与修复方案，覆盖 Python/Java 场景
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
Archive multiple completed changes at once. Use when archiving several parallel changes.
Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
| id | security/web-security-guide |
| name | Web 安全漏洞学习指南 |
| category | security |
| description | OWASP 十大漏洞原理、影响与修复方案，覆盖 Python/Java 场景 |
| tags | ["security","owasp","vulnerability","injection","xss","csrf","ssrf"] |
| updated_at | "2026-01-23T00:00:00.000Z" |
| 漏洞 | 危害 | 核心防御 |
|---|---|---|
| 🔴 注入 | RCE/数据泄露 | 参数化查询 |
| 🔴 XSS | 会话劫持 | 转义输出 |
| 🔴 认证缺陷 | 账户接管 | 强Token+限速 |
| 🔴 敏感数据泄露 | 隐私泄露 | 加密+脱敏 |
| 🔴 访问控制缺失 | 越权操作 | 后端鉴权 |
| 🟡 安全配置错误 | 信息泄露 | 关闭Debug |
| 🟡 CSRF | 伪造操作 | Token验证 |
| 🟡 反序列化 | RCE | 禁用危险接口 |
| 🟡 SSRF | 内网探测 | 白名单URL |
| ⚪ 日志不足 | 无法溯源 | 完整审计 |
| 漏洞类型 | URI |
|---|---|
| 注入漏洞 | skill://web-security-guide/references/injection.md |
| XSS攻击 | skill://web-security-guide/references/xss.md |
| 认证会话 | skill://web-security-guide/references/auth-session.md |
| 数据泄露 | skill://web-security-guide/references/data-exposure.md |
| 访问控制 | skill://web-security-guide/references/access-control.md |
| 配置错误 | skill://web-security-guide/references/security-config.md |
| CSRF | skill://web-security-guide/references/csrf.md |
| 反序列化 | skill://web-security-guide/references/deserialization.md |
| SSRF | skill://web-security-guide/references/ssrf.md |
| 日志监控 | skill://web-security-guide/references/logging-monitoring.md |
💡 先用速查表定位问题，再按需加载详细文档
skill://web-security-guide/references/access-control.mdskill://web-security-guide/references/auth-session.mdskill://web-security-guide/references/csrf.mdskill://web-security-guide/references/data-exposure.mdskill://web-security-guide/references/deserialization.mdskill://web-security-guide/references/injection.mdskill://web-security-guide/references/logging-monitoring.mdskill://web-security-guide/references/security-config.mdskill://web-security-guide/references/ssrf.mdskill://web-security-guide/references/xss.md根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载