3stoneBrother

Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.

Evaluates, repairs, creates, and audits Claude Skills using an 8-module quality framework with weighted scoring. Performs structural scanning, anti-pattern detection, completeness verification, discovery validation, and decision-gate checks. Use when checking Skill quality ("check skill", "skill 质量", "评估这个 skill", "review skill", "skill 好不好", "skill 总是不触发", "skill 输出不稳定"), fixing Skill defects ("fix skill", "修复 skill"), creating new Skills ("创建 skill", "新建 skill"), or auditing multi-Skill route conflicts ("审计 skill", "系统审计"). Also triggers on: "evaluate skill", "audit skill system", "skill quality report", "grade this skill". Do not use for general code review, non-Skill documentation, Skill design concept discussions without a concrete target, or runtime debugging.