Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

sec-audit-dast

Étoiles3

Forks0

Mis à jour19 mai 2026 à 04:38

DAST/ASM workflow for external asset discovery, probing, and scanning with SARIF output. Use for runtime/endpoint-based assessments and asset management scanning.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

windshock

windshock/oh-my-secuaudit

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

Explorateur de fichiers

15 fichiers

SKILL.md

readonly

name	sec-audit-dast
description	DAST/ASM workflow for external asset discovery, probing, and scanning with SARIF output. Use for runtime/endpoint-based assessments and asset management scanning.

Sec Audit DAST

Overview

Run DAST/ASM pipelines (URL track and IP track) and produce SARIF outputs for findings. Use this when scanning live targets or external surfaces.

Workflow

Read DAST references:

references/asm_sources.md for canonical docs and process context.
references/asm_scripts.md for the script entrypoints.
references/asm_csv.md for CSV extraction from ASM outputs.
references/sarif_conversion.md for CSV->SARIF conversion when needed.
references/severity_criteria.md plus references/severity_criteria_detail.md for risk mapping.
references/reporting_summary.md for the cross-skill summary index format.

Execute the appropriate track:

URL Track: discovery -> probing -> scanners -> SARIF output.
IP Track: IP list -> service/daemon detection -> SARIF output.

Normalize outputs to SARIF for reporting.
When producing JSON findings (or SARIF-to-JSON normalization), require:

provenance with one of binary-confirmed|source-confirmed|runtime-confirmed|not-confirmed
impacted_flow with one or more architecture flow IDs (F1, F2, ...)

Reporting

Primary output: SARIF (.sarif) per scan batch.
Use severity mapping from references/severity_criteria.md and detailed criteria in references/severity_criteria_detail.md.
Produce a common summary JSON using schemas/reporting_summary_schema.json in this skill directory.
Use local scripts in this skill directory for conversion and summary generation.
If task/finding JSON is emitted, validate against schemas/task_output_schema.json and schemas/finding_schema.json.

Resources

references/

references/asm_sources.md
references/asm_scripts.md
references/asm_csv.md
references/sarif_conversion.md
references/severity_criteria.md
references/severity_criteria_detail.md
references/reporting_summary.md

scripts/

scripts/asm_findings_to_csv.py
scripts/sarif_from_csv.py
scripts/generate_reporting_summary.py

schemas/

schemas/reporting_summary_schema.json
schemas/task_output_schema.json
schemas/finding_schema.json

Plus depuis ce dépôt

même dépôt

sec-reference-retrieval

windshock/oh-my-secuaudit

Query multi-source AppSec catalogs (CWE / OWASP Cheat Sheet Series / GitHub Advisory Database / AppSec.fyi) for a given security finding and propose a synthesis row to the security-field-notes synthesis-ledger via PR. Use when a producer skill (sec-audit-static, sec-audit-dast, external-software-analysis) emits a finding that needs external reference enrichment, or when packaging an assessment finding for downstream remediation context.

2026-05-213

security-testing-as-code

windshock/oh-my-secuaudit

Transform security assessment deliverables from static documents (Word/Excel/portal) into version-controlled, executable projects. PoCs replace narrative claims; saved HTTP requests replace checkboxes; commit hashes enable exact-state reproduction. Use when scoping methodology for an audit, when an existing assessment needs to be made reproducible, or when assessment outputs must be inheritable across teams.

2026-05-203

external-software-analysis

windshock/oh-my-secuaudit

External software analysis workflows for binaries/packages (decompilation, reverse engineering, static analysis, fuzzing, and evidence collection). Use when analyzing third-party software without source access.

2026-05-193

sec-audit-static

windshock/oh-my-secuaudit

Static code security audit playbook (SAST, SCA, secret detection) with standardized JSON outputs and reporting. Use for source-code based assessments, schema validation, and generating final reports.

2026-05-193

sec-cluster

windshock/oh-my-secuaudit

Dataflow-based code clustering for security assessments. Groups (Endpoint, Sink) paths by shared review strategy so reviewers sample representative cases instead of exhaustively reviewing every path. Use when scoping manual review on a codebase with 50+ endpoints, repetitive sanitization patterns, or after initial SAST/SCA produces large finding sets that need triage.

2026-05-193

security-architecture-review

windshock/oh-my-secuaudit

Security architecture review for codebases, producing Data Flow Diagram (DFD) with trust boundaries, Attack Flow overlay, scoped attack surface inventory, sensitive data map, and risk summary grounded in code. Use when asked to perform architecture-focused security review, reconstruct security design from code, or produce DFD/attack-flow documentation.

2026-05-193

Sec Audit DAST

Overview

Run DAST/ASM pipelines (URL track and IP track) and produce SARIF outputs for findings. Use this when scanning live targets or external surfaces.

Workflow

Read DAST references:

references/asm_sources.md for canonical docs and process context.

references/asm_scripts.md for the script entrypoints.

references/asm_csv.md for CSV extraction from ASM outputs.

references/sarif_conversion.md for CSV->SARIF conversion when needed.

references/severity_criteria.md plus references/severity_criteria_detail.md for risk mapping.

references/reporting_summary.md for the cross-skill summary index format.

Execute the appropriate track:

URL Track: discovery -> probing -> scanners -> SARIF output.

IP Track: IP list -> service/daemon detection -> SARIF output.

Normalize outputs to SARIF for reporting.

When producing JSON findings (or SARIF-to-JSON normalization), require:

provenance with one of binary-confirmed|source-confirmed|runtime-confirmed|not-confirmed

impacted_flow with one or more architecture flow IDs (F1, F2, ...)

Reporting

Primary output: SARIF (.sarif) per scan batch.

Use severity mapping from references/severity_criteria.md and detailed criteria in references/severity_criteria_detail.md.

Produce a common summary JSON using schemas/reporting_summary_schema.json in this skill directory.

Use local scripts in this skill directory for conversion and summary generation.

If task/finding JSON is emitted, validate against schemas/task_output_schema.json and schemas/finding_schema.json.

Resources

references/

references/asm_sources.md

references/asm_scripts.md

references/asm_csv.md

references/sarif_conversion.md

references/severity_criteria.md

references/severity_criteria_detail.md

references/reporting_summary.md

scripts/

scripts/asm_findings_to_csv.py

scripts/sarif_from_csv.py

scripts/generate_reporting_summary.py

schemas/

schemas/reporting_summary_schema.json

schemas/task_output_schema.json

schemas/finding_schema.json