القائمة
DAST/ASM workflow for external asset discovery, probing, and scanning with SARIF output. Use for runtime/endpoint-based assessments and asset management scanning.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Query multi-source AppSec catalogs (CWE / OWASP Cheat Sheet Series / GitHub Advisory Database / AppSec.fyi) for a given security finding and propose a synthesis row to the security-field-notes synthesis-ledger via PR. Use when a producer skill (sec-audit-static, sec-audit-dast, external-software-analysis) emits a finding that needs external reference enrichment, or when packaging an assessment finding for downstream remediation context.
Transform security assessment deliverables from static documents (Word/Excel/portal) into version-controlled, executable projects. PoCs replace narrative claims; saved HTTP requests replace checkboxes; commit hashes enable exact-state reproduction. Use when scoping methodology for an audit, when an existing assessment needs to be made reproducible, or when assessment outputs must be inheritable across teams.
External software analysis workflows for binaries/packages (decompilation, reverse engineering, static analysis, fuzzing, and evidence collection). Use when analyzing third-party software without source access.
Static code security audit playbook (SAST, SCA, secret detection) with standardized JSON outputs and reporting. Use for source-code based assessments, schema validation, and generating final reports.
Dataflow-based code clustering for security assessments. Groups (Endpoint, Sink) paths by shared review strategy so reviewers sample representative cases instead of exhaustively reviewing every path. Use when scoping manual review on a codebase with 50+ endpoints, repetitive sanitization patterns, or after initial SAST/SCA produces large finding sets that need triage.
Security architecture review for codebases, producing Data Flow Diagram (DFD) with trust boundaries, Attack Flow overlay, scoped attack surface inventory, sensitive data map, and risk summary grounded in code. Use when asked to perform architecture-focused security review, reconstruct security design from code, or produce DFD/attack-flow documentation.
| name | sec-audit-dast |
| description | DAST/ASM workflow for external asset discovery, probing, and scanning with SARIF output. Use for runtime/endpoint-based assessments and asset management scanning. |
Run DAST/ASM pipelines (URL track and IP track) and produce SARIF outputs for findings. Use this when scanning live targets or external surfaces.
references/asm_sources.md for canonical docs and process context.references/asm_scripts.md for the script entrypoints.references/asm_csv.md for CSV extraction from ASM outputs.references/sarif_conversion.md for CSV->SARIF conversion when needed.references/severity_criteria.md plus references/severity_criteria_detail.md for risk mapping.references/reporting_summary.md for the cross-skill summary index format.provenance with one of binary-confirmed|source-confirmed|runtime-confirmed|not-confirmedimpacted_flow with one or more architecture flow IDs (F1, F2, ...).sarif) per scan batch.references/severity_criteria.md and detailed criteria in references/severity_criteria_detail.md.schemas/reporting_summary_schema.json in this skill directory.schemas/task_output_schema.json and schemas/finding_schema.json.references/asm_sources.mdreferences/asm_scripts.mdreferences/asm_csv.mdreferences/sarif_conversion.mdreferences/severity_criteria.mdreferences/severity_criteria_detail.mdreferences/reporting_summary.mdscripts/asm_findings_to_csv.pyscripts/sarif_from_csv.pyscripts/generate_reporting_summary.pyschemas/reporting_summary_schema.jsonschemas/task_output_schema.jsonschemas/finding_schema.json