Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

security-auditor

Sterne5

Forks2

Aktualisiert2. April 2026 um 07:02

Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

nevergoodstudy-hub

nevergoodstudy-hub/wechat-article-summarizer

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes

Mehr aus diesem Repository

gleiches Repository

ai-multimodal

nevergoodstudy-hub/wechat-article-summarizer

Process and generate multimedia content using Google Gemini API. Capabilities include analyze audio files (transcription with timestamps, summarization, speech understanding, music/sound analysis up to 9.5 hours), understand images (captioning, object detection, OCR, visual Q&A, segmentation), process videos (scene detection, Q&A, temporal analysis, YouTube URLs, up to 6 hours), extract from documents (PDF tables, forms, charts, diagrams, multi-page), generate images (text-to-image, editing, composition, refinement). Use when working with audio/video files, analyzing images or screenshots, processing PDF documents, extracting structured data from media, creating images from text prompts, or implementing multimodal AI features. Supports multiple models (Gemini 2.5/2.0) with context windows up to 2M tokens.

2026-04-025

asyncio-taskgroup-migration

nevergoodstudy-hub/wechat-article-summarizer

Migrate all asyncio.gather() calls to asyncio.TaskGroup for structured concurrency. Use this skill to fix P1-2: replace gather with TaskGroup context managers, add Semaphore-based backpressure for concurrent operations, and use except* for ExceptionGroup handling. Targets Python 3.11+ structured concurrency patterns.

2026-04-025

bug-fixer

nevergoodstudy-hub/wechat-article-summarizer

Fix known bugs in the WeChat Article Summarizer project. Use this skill when investigating and fixing code bugs including: deprecated API usage, missing imports, type errors, null safety issues, and container initialization problems. Targets BUG-001 through BUG-006 from the project's TEST_ISSUES.txt.

2026-04-025

ci-cd-setup

nevergoodstudy-hub/wechat-article-summarizer

Set up a complete CI/CD pipeline using GitHub Actions. Use this skill to fix P2-8: create workflows for linting (ruff), type checking (mypy), testing (pytest with timeout), security scanning (pip-audit), and build verification. Includes dependency caching and matrix testing for Python 3.12-3.14.

2026-04-025

code-quality

nevergoodstudy-hub/wechat-article-summarizer

Improve code quality in the WeChat Article Summarizer project. Use this skill for automated code style fixes (ruff), test infrastructure improvements, and pytest-timeout setup. Targets WARN-001 (4711 ruff issues) and WARN-004 (test suite structural defects) from TEST_ISSUES.txt.

2026-04-025

container-lazy-init

nevergoodstudy-hub/wechat-article-summarizer

Refactor the DI container from eager to lazy initialization to unblock 186 tests. Use this skill to fix P0-1: convert container.py to use cached_property/lazy providers, create a test container with mock adapters in conftest.py, and eliminate module-level container instantiation across the codebase.

2026-04-025

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes