Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

security-auditor

Étoiles5

Forks2

Mis à jour2 avril 2026 à 07:02

Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

nevergoodstudy-hub

nevergoodstudy-hub/wechat-article-summarizer

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes

Plus depuis ce dépôt

même dépôt

ai-multimodal

nevergoodstudy-hub/wechat-article-summarizer

Process and generate multimedia content using Google Gemini API. Capabilities include analyze audio files (transcription with timestamps, summarization, speech understanding, music/sound analysis up to 9.5 hours), understand images (captioning, object detection, OCR, visual Q&A, segmentation), process videos (scene detection, Q&A, temporal analysis, YouTube URLs, up to 6 hours), extract from documents (PDF tables, forms, charts, diagrams, multi-page), generate images (text-to-image, editing, composition, refinement). Use when working with audio/video files, analyzing images or screenshots, processing PDF documents, extracting structured data from media, creating images from text prompts, or implementing multimodal AI features. Supports multiple models (Gemini 2.5/2.0) with context windows up to 2M tokens.

2026-04-025

asyncio-taskgroup-migration

nevergoodstudy-hub/wechat-article-summarizer

Migrate all asyncio.gather() calls to asyncio.TaskGroup for structured concurrency. Use this skill to fix P1-2: replace gather with TaskGroup context managers, add Semaphore-based backpressure for concurrent operations, and use except* for ExceptionGroup handling. Targets Python 3.11+ structured concurrency patterns.

2026-04-025

bug-fixer

nevergoodstudy-hub/wechat-article-summarizer

Fix known bugs in the WeChat Article Summarizer project. Use this skill when investigating and fixing code bugs including: deprecated API usage, missing imports, type errors, null safety issues, and container initialization problems. Targets BUG-001 through BUG-006 from the project's TEST_ISSUES.txt.

2026-04-025

ci-cd-setup

nevergoodstudy-hub/wechat-article-summarizer

Set up a complete CI/CD pipeline using GitHub Actions. Use this skill to fix P2-8: create workflows for linting (ruff), type checking (mypy), testing (pytest with timeout), security scanning (pip-audit), and build verification. Includes dependency caching and matrix testing for Python 3.12-3.14.

2026-04-025

code-quality

nevergoodstudy-hub/wechat-article-summarizer

Improve code quality in the WeChat Article Summarizer project. Use this skill for automated code style fixes (ruff), test infrastructure improvements, and pytest-timeout setup. Targets WARN-001 (4711 ruff issues) and WARN-004 (test suite structural defects) from TEST_ISSUES.txt.

2026-04-025

container-lazy-init

nevergoodstudy-hub/wechat-article-summarizer

Refactor the DI container from eager to lazy initialization to unblock 186 tests. Use this skill to fix P0-1: convert container.py to use cached_property/lazy providers, create a test container with mock adapters in conftest.py, and eliminate module-level container instantiation across the codebase.

2026-04-025

name	security-auditor
description	Audit and fix security issues in the WeChat Article Summarizer project. Use this skill for security-related code fixes including: PBKDF2 salt hardening, MCP audit log sanitization improvements, and SSRF DNS rebinding protection. Targets WARN-002, WARN-003, WARN-005 from TEST_ISSUES.txt.

Security Auditor Agent

Investigate and fix security warnings in the WeChat Article Summarizer project.

Project Context

Python 3.10+ project, source in src/wechat_summarizer/
Security module: src/wechat_summarizer/shared/utils/security.py
MCP security: src/wechat_summarizer/mcp/security.py
URL validation: src/wechat_summarizer/domain/value_objects/url.py

Security Issues

WARN-002: PBKDF2 fixed salt value

File: src/wechat_summarizer/shared/utils/security.py
Problem: Check if PBKDF2 key derivation still uses a fixed salt b"wechat_summarizer_v2". If a _get_or_create_salt() function exists and uses secrets.token_bytes(), this may already be fixed.
Verify: Read the file and confirm the salt is randomly generated and persisted.
If not fixed: Replace fixed salt with os.urandom(16) or secrets.token_bytes(32), persist in a salt file.

WARN-003: MCP audit log sanitization incomplete

File: src/wechat_summarizer/mcp/security.py (AuditLogger._sanitize_args)
Problem: Only checks key names for sensitive words, doesn't inspect string values for API key patterns or truncate long strings.
Fix:
1. Add string length truncation (>200 chars → truncate with "...[truncated]")
2. Add regex check for API key patterns in values (e.g., sk-, key-, base64-like long strings)
3. Recursively sanitize nested dict/list values

WARN-005: SSRF no DNS rebinding protection

File: src/wechat_summarizer/domain/value_objects/url.py
Problem: _is_private_address() only checks hostname strings, not resolved IPs. DNS rebinding can bypass this.
Fix approach: Document the limitation and add a utility function for connection-level IP checking that can be used by the HTTP client layer. Add a validate_resolved_ip() function.

Execution Steps

Read each affected file
Assess the current state (some issues may already be fixed)
Apply targeted fixes
Report findings and changes