appsec-audit

Stars8

Forks0

UpdatedMay 27, 2026 at 17:06

Application security audit focused on URL and input trust boundaries, SSRF-style risks, redirects, metadata endpoints, allowlists, and evidence-backed findings.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

infiquetra

infiquetra/infiquetra-claude-plugins

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	appsec-audit
description	Application security audit focused on URL and input trust boundaries, SSRF-style risks, redirects, metadata endpoints, allowlists, and evidence-backed findings.
when_to_use	Use when reviewing code that accepts URLs, fetches remote resources, follows redirects, proxies requests, imports external data, parses user-controlled input, or touches network egress controls.

AppSec Audit

Use this skill to audit application code for URL and input trust boundary risks. Focus on evidence-backed findings, not speculative concerns.

Scope

Review:

User-controlled URLs, hosts, paths, query strings, headers, and webhook destinations.
HTTP clients, redirect handling, proxy code, file importers, and fetch/download helpers.
SSRF-style paths to cloud metadata endpoint addresses and internal networks.
DNS rebinding, scheme confusion, localhost/private-network access, and open redirects.
Allowlist and blocklist enforcement.
Input parsing at trust boundaries.

Process

Map external inputs and trust boundaries.
Trace each input to network, file, shell, database, template, or redirect sinks.
Check validation order: parse, canonicalize, validate, then use.
Confirm allowlists are positive and exact enough for the risk.
Check redirects do not escape the approved destination set.
Check cloud metadata endpoint protections and private network restrictions.
Produce findings only when code evidence supports the risk.

SSRF Checklist

Reject non-HTTP schemes unless explicitly required.
Reject localhost, loopback, link-local, private, multicast, and unspecified addresses.
Protect metadata endpoints, including 169.254.169.254 and provider-specific hostnames.
Re-resolve DNS or pin validated IPs when redirects or retries occur.
Validate every redirect hop.
Enforce outbound allowlists at the URL/host layer and, where possible, network egress layer.
Set conservative timeouts and response size limits.

Finding Format

## AppSec Audit Finding

**Severity**: [Critical/High/Medium/Low]
**Category**: [SSRF / redirect / input validation / allowlist / metadata endpoint / other]
**File**: [path:line]
**Evidence**: [Specific code behavior and data flow]
**Impact**: [What an attacker can do]
**Fix**: [Concrete remediation]
**Validation**: [How to prove the fix]

If no findings are found, state the files reviewed and any residual test gaps.

More from this repository

same repository

hermes-profile-evolution

infiquetra/infiquetra-claude-plugins

Route proposed Team Mimir profile behavior changes to target-owned Hermes dialogue.

2026-08-018

agy-delegate

infiquetra/infiquetra-claude-plugins

Build a versioned Antigravity teammate delegation envelope and route it through the guarded agy wrapper.

2026-07-298

plan

infiquetra/infiquetra-claude-plugins

Create durable Infiquetra implementation plans with issue, review, test, and deploy gates. Interrogates HOW work gets built, writes an agent-consumable plan artifact, records a plan saga, and routes to doc-review and /work. Triggers on "plan this", "how should we build this", "create a plan", "break this down", or a handoff issue ready for planning.

2026-07-278

outcome

infiquetra/infiquetra-claude-plugins

Coordinate a whole outcome as a durable DAG of leaf sagas. A level-triggered reconcile loop that dispatches the ready frontier to executors, harvests completion, and pages the operator only at gates and exceptions. The coordinator routes and never runs leaf work; status is derived on read. Thin coordinator verbs only — start, graph, advance, attend, resume, discover, handoff, attach — leaf work stays the native /resume, /work, /code-review, /qa.

2026-07-278

work

infiquetra/infiquetra-claude-plugins

Execute a settled Infiquetra plan to PR-ready, then own the round-N PR continuation loop. Restores and writes the work-thread saga (the primary writer), recommends an execution backend, runs risk-gated tests, calls /code-review programmatically and reads its envelope, gates hard on P0/P1 and stale reviews, and coordinates PR-open/review-request/merge under explicit confirmation — without owning deploy. Triggers on "build it", "work this plan", "execute the plan", "resume work on

2026-07-278

brainstorm

infiquetra/infiquetra-claude-plugins

Deep-dive one chosen Infiquetra idea into a right-sized requirements document before planning.

2026-07-278

AppSec Audit

Use this skill to audit application code for URL and input trust boundary risks. Focus on evidence-backed findings, not speculative concerns.

Scope

Review:

User-controlled URLs, hosts, paths, query strings, headers, and webhook destinations.

HTTP clients, redirect handling, proxy code, file importers, and fetch/download helpers.

SSRF-style paths to cloud metadata endpoint addresses and internal networks.

DNS rebinding, scheme confusion, localhost/private-network access, and open redirects.

Allowlist and blocklist enforcement.

Input parsing at trust boundaries.

Process

Map external inputs and trust boundaries.

Trace each input to network, file, shell, database, template, or redirect sinks.

Check validation order: parse, canonicalize, validate, then use.

Confirm allowlists are positive and exact enough for the risk.

Check redirects do not escape the approved destination set.

Check cloud metadata endpoint protections and private network restrictions.

Produce findings only when code evidence supports the risk.

SSRF Checklist

Reject non-HTTP schemes unless explicitly required.

Reject localhost, loopback, link-local, private, multicast, and unspecified addresses.

Protect metadata endpoints, including 169.254.169.254 and provider-specific hostnames.

Re-resolve DNS or pin validated IPs when redirects or retries occur.

Validate every redirect hop.

Enforce outbound allowlists at the URL/host layer and, where possible, network egress layer.

Set conservative timeouts and response size limits.

Finding Format

## AppSec Audit Finding **Severity**: [Critical/High/Medium/Low] **Category**: [SSRF / redirect / input validation / allowlist / metadata endpoint / other] **File**: [path:line] **Evidence**: [Specific code behavior and data flow] **Impact**: [What an attacker can do] **Fix**: [Concrete remediation] **Validation**: [How to prove the fix]

If no findings are found, state the files reviewed and any residual test gaps.