jnMetaCode/security-audit-skill-zh

Latest recorded source activity: October 5, 2026 at 02:43

SkillsMP catalog refreshed: November 2, 2026 at 18:02

skills collected: 1

GitHub stars: 2
GitHub forks: 0

Install with an AI assistant

Copy this prompt into the AI assistant you're using.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/jnMetaCode/security-audit-skill-zh.

Repository README

Repository README source: README.md

Read the source README

Expand full README

# Security Audit Skill 中文社区增强版 > 让编码 Agent 按证据审计 Spring Security 和中国技术栈，而不是靠关键词猜漏洞。 [![M1 Preview](https://img.shields.io/badge/status-M1%20Preview-d97706)](README.zh-CN.md) [![Upstream](https://img.shields.io/badge/upstream-c1c8a8c-1d6358)](upstream-lock.json) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![CI](https://github.com/jnMetaCode/security-audit-skill-zh/actions/workflows/ci.yml/badge.svg)](https://github.com/jnMetaCode/security-audit-skill-zh/actions/workflows/ci.yml) 这是 Cloudflare Security Audit Skill 的非官方中文社区增强版。当前 M1 预览包含中文安全边界与六阶段路由、Spring Security 增量 Profile、5 个可复现 fixture、上游兼容的 schema/validator，以及确定性的本地化合成和中文报告工具。 **[阅读中文文档](README.zh-CN.md)** · [贡献指南](CONTRIBUTING.md) · [安全策略](SECURITY.md) · [上游项目](https://github.com/cloudflare/security-audit-skill) ```bash npm run check npm test npm run compose ``` > [!IMPORTANT] > 当前不是稳定发行版。默认只进行只读 Guidance；未满足断网、空环境、只读目标、scratch-only 写入和资源限制时，不得执行目标控制代码。本项目与 Cloudflare 不存在官方隶属或背书关系。 --- ## Upstream English documentation # security-audit A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. This is the skill that seeded Cloudflare's vulnerability discovery harness, described in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from. ## What it does The skill runs a structured audit in six phases: 1. **Reconnaissance** -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in `architecture.md` and `coverage-ledger.json`. 2. **Coverage-led hunting** -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps. 3. **Candidate validation** -- give every unique candidate to a fresh verifier that tries to disprove it. 4. **Structured output** -- write `confirmed`, `needs_validation`, and `rejected` records to `findings.json` and validate them against `report-schema.json`. 5. **Independent record verification** -- fresh agents verify final source claims. Material replacements receive another independent verifier. 6. **Target-neutral reporting** -- derive `REPORT.md`, `FINDINGS-DETAIL.md`, and `NEEDS-VALIDATION.md` from the verified records and coverage ledger. The parent runs `validate-coverage-ledger.cjs` after creating the ledger and after each later ledger update. It runs `validate-findings.cjs` in Phase 4 and again after every Phase 5 replacement. The verdicts are distinct: `confirmed` has a complete source trace and bounded observed result, `needs_validation` has an exact unresolved fact and no severity, and `rejected` records a disproved candidate. Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered. ## Files | File | Purpose | |------|---------| | `SKILL.md` | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns | | `RECONNAISSANCE.md` | Phase 1 reconnaissance prompts and synthesis instructions | | `HUNTING.md` | Phase 2 orchestration, hunting methodology, and validation rules | | `ATTACK-CLASSES.md` | Core, wildcard, and obvious-things attack prompts | | `MEMORY-SAFETY-AND-BINARY.md` | Memory-safety, binary, and kernel hunting classes for native targets | | `AI-AND-LLM.md` | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets | | `WEB-PROTOCOL-AND-AUTH.md` | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets | | `CLIENT-SIDE.md` | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets | | `SUPPLY-CHAIN-AND-RELEASE.md` | Dependency, CI, release, signing, update, plugin, and extension hunting classes | | `CLOUD-AND-DEPLOYMENT.md` | IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes | | `PROTOCOLS-RPC-AND-MESSAGING.md` | RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes | | `RESOURCE-EXHAUSTION-AND-AVAILABILITY.md` | Shared resource, quota, queue, worker, and operator-spend hunting classes | | `DATA-ISOLATION-AND-LIFECYCLE.md` | Tenant isolation, cache, search, export, backup, migration, deletion, and restore hunting classes | | `DESKTOP-MOBILE-AND-LOCAL-IPC.md` | Native app, deep-link, webview, exported-component, helper, daemon, and local-IPC hunting classes | | `VALIDATION-AND-REPORTING.md` | Phases 3–6 candidate validation, structured output, record verification, and reporting | | `report-schema.json` | JSON schema for all three `findings.json` verdicts | | `validate-findings.cjs` | Zero-dependency validator for `findings.json` in Phases 4 and 5 | | `validate-findings.test.cjs` | Findings-validator tests and producer-compatible fixture checks | | `validate-coverage-ledger.cjs` | Zero-dependency validator for `coverage-ledger.json` in Phases 1–5 | | `validate-coverage-ledger.test.cjs` | Coverage-ledger validator tests | ## Installation Install the skill with the [Skills CLI](https://skills.sh): ```bash npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit ``` Use `--global` for a user-level installation: ```bash npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit \ --global ``` Run `npx skills --help` for agent-selection and non-interactive options. ## Usage Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit: ``` security audit this codebase ``` ``` find security vulnerabilities in ./src ``` ``` do a security review, output to ~/audits/my-project ``` The skill activates automatically when the request matches its trigger (security audit, find vulnerabilities, pen-test the code, etc.). A direct codebase audit or pen-test request uses full audit mode. Security questions and focused vulnerability work use guidance mode unless you request report artifacts. In full audit mode, an unspecified output directory defaults to `~/security-audit-skill/<repo-name>/run-<N>`. The workflow writes inside the target repository only when you explicitly select a directory that version control ignores. ## Requirements - A coding agent with a model that supports tool use and parallel sub-agents - Node.js for the zero-dependency findings and coverage-ledger validators - An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. It must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths. Without these controls, the workflow keeps the lead as `needs_validation` instead of executing target code. ## Design principles - **Only confirm established boundary failures.** Keep a source-grounded blocked lead as `needs_validation` with its exact unresolved fact. - **Adversarial validation.** The agent that checks a finding is never the agent that found it. - **Severity requires impact.** Likelihood x impact, not deviation from a checklist. - **Defense-in-depth gaps are not vulnerabilities.** If Layer A prevents the attack, the absence of Layer B is a hardening note. - **Multiple runs improve coverage.** In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total. ## Contact Questions, feedback, or comparing notes on AI-driven security tooling: security-ai-research@cloudflare.com ## License MIT -- see [LICENSE](LICENSE).

Loading the repository README…

Skills in this repository

classification pending

skill

occupation

description

updated

security-audit-zh

unclassified

面向代码库、API、服务、CLI、库与守护进程的中文安全指导和漏洞审计。用于安全问题、定向复核、漏洞研究或明确授权的完整代码审计；只有用户明确要求完整审计、渗透测试或报告产物时才运行六阶段流程。

Source text: Chinese

2026-10-05

Showing 1 of 1 collected skill.