Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

security-auditor

Estrellas5

Forks2

Actualizado2 de abril de 2026 a las 07:02

Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

nevergoodstudy-hub

nevergoodstudy-hub/wechat-article-summarizer

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes

Más de este repositorio

mismo repositorio

ai-multimodal

nevergoodstudy-hub/wechat-article-summarizer

Process and generate multimedia content using Google Gemini API. Capabilities include analyze audio files (transcription with timestamps, summarization, speech understanding, music/sound analysis up to 9.5 hours), understand images (captioning, object detection, OCR, visual Q&A, segmentation), process videos (scene detection, Q&A, temporal analysis, YouTube URLs, up to 6 hours), extract from documents (PDF tables, forms, charts, diagrams, multi-page), generate images (text-to-image, editing, composition, refinement). Use when working with audio/video files, analyzing images or screenshots, processing PDF documents, extracting structured data from media, creating images from text prompts, or implementing multimodal AI features. Supports multiple models (Gemini 2.5/2.0) with context windows up to 2M tokens.

2026-04-025

asyncio-taskgroup-migration

nevergoodstudy-hub/wechat-article-summarizer

Migrate all asyncio.gather() calls to asyncio.TaskGroup for structured concurrency. Use this skill to fix P1-2: replace gather with TaskGroup context managers, add Semaphore-based backpressure for concurrent operations, and use except* for ExceptionGroup handling. Targets Python 3.11+ structured concurrency patterns.

2026-04-025

bug-fixer

nevergoodstudy-hub/wechat-article-summarizer

Fix known bugs in the WeChat Article Summarizer project. Use this skill when investigating and fixing code bugs including: deprecated API usage, missing imports, type errors, null safety issues, and container initialization problems. Targets BUG-001 through BUG-006 from the project's TEST_ISSUES.txt.

2026-04-025

ci-cd-setup

nevergoodstudy-hub/wechat-article-summarizer

Set up a complete CI/CD pipeline using GitHub Actions. Use this skill to fix P2-8: create workflows for linting (ruff), type checking (mypy), testing (pytest with timeout), security scanning (pip-audit), and build verification. Includes dependency caching and matrix testing for Python 3.12-3.14.

2026-04-025

code-quality

nevergoodstudy-hub/wechat-article-summarizer

Improve code quality in the WeChat Article Summarizer project. Use this skill for automated code style fixes (ruff), test infrastructure improvements, and pytest-timeout setup. Targets WARN-001 (4711 ruff issues) and WARN-004 (test suite structural defects) from TEST_ISSUES.txt.

2026-04-025

container-lazy-init

nevergoodstudy-hub/wechat-article-summarizer

Refactor the DI container from eager to lazy initialization to unblock 186 tests. Use this skill to fix P0-1: convert container.py to use cached_property/lazy providers, create a test container with mock adapters in conftest.py, and eliminate module-level container instantiation across the codebase.

2026-04-025

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes