Run any Skill in Manus with one click

security-auditor

Stars5

Forks2

UpdatedApril 2, 2026 at 07:02

Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

nevergoodstudy-hub

nevergoodstudy-hub/wechat-article-summarizer

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes

More from this repository

same repository

ai-multimodal

nevergoodstudy-hub/wechat-article-summarizer

Process and generate multimedia content using Google Gemini API. Capabilities include analyze audio files (transcription with timestamps, summarization, speech understanding, music/sound analysis up to 9.5 hours), understand images (captioning, object detection, OCR, visual Q&A, segmentation), process videos (scene detection, Q&A, temporal analysis, YouTube URLs, up to 6 hours), extract from documents (PDF tables, forms, charts, diagrams, multi-page), generate images (text-to-image, editing, composition, refinement). Use when working with audio/video files, analyzing images or screenshots, processing PDF documents, extracting structured data from media, creating images from text prompts, or implementing multimodal AI features. Supports multiple models (Gemini 2.5/2.0) with context windows up to 2M tokens.

2026-04-025

asyncio-taskgroup-migration

nevergoodstudy-hub/wechat-article-summarizer

Migrate all asyncio.gather() calls to asyncio.TaskGroup for structured concurrency. Use this skill to fix P1-2: replace gather with TaskGroup context managers, add Semaphore-based backpressure for concurrent operations, and use except* for ExceptionGroup handling. Targets Python 3.11+ structured concurrency patterns.

2026-04-025

bug-fixer

nevergoodstudy-hub/wechat-article-summarizer

Fix known bugs in the WeChat Article Summarizer project. Use this skill when investigating and fixing code bugs including: deprecated API usage, missing imports, type errors, null safety issues, and container initialization problems. Targets BUG-001 through BUG-006 from the project's TEST_ISSUES.txt.

2026-04-025

ci-cd-setup

nevergoodstudy-hub/wechat-article-summarizer

Set up a complete CI/CD pipeline using GitHub Actions. Use this skill to fix P2-8: create workflows for linting (ruff), type checking (mypy), testing (pytest with timeout), security scanning (pip-audit), and build verification. Includes dependency caching and matrix testing for Python 3.12-3.14.

2026-04-025

code-quality

nevergoodstudy-hub/wechat-article-summarizer

Improve code quality in the WeChat Article Summarizer project. Use this skill for automated code style fixes (ruff), test infrastructure improvements, and pytest-timeout setup. Targets WARN-001 (4711 ruff issues) and WARN-004 (test suite structural defects) from TEST_ISSUES.txt.

2026-04-025

container-lazy-init

nevergoodstudy-hub/wechat-article-summarizer

Refactor the DI container from eager to lazy initialization to unblock 186 tests. Use this skill to fix P0-1: convert container.py to use cached_property/lazy providers, create a test container with mock adapters in conftest.py, and eliminate module-level container instantiation across the codebase.

2026-04-025

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes