菜单
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | graudit-security-scan |
| description | Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages. |
| applyTo | ** |
Graudit is a grep-based source code auditing tool that uses regex signature databases to detect dangerous patterns across many languages.
# Scan with default database
graudit /path/to/scan
# Language-specific scan
graudit -d python /path/to/scan
graudit -d js /path/to/scan
graudit -d go /path/to/scan
# Critical: always run for untrusted code
graudit -d exec /path/to/scan # Command injection, reverse shells
graudit -d secrets /path/to/scan # Hardcoded credentials, API keys
# Additional databases
graudit -d sql /path/to/scan # SQL injection
graudit -d xss /path/to/scan # Cross-site scripting
# Exclude noise
graudit -x "*.min.js,node_modules/*,vendor/*,.git/*" -d secrets /path
# Show more context lines
graudit -c 3 -d exec /path/to/scan
# List available databases
graudit -l
| Database | Detects |
|---|---|
exec | Command injection, reverse shells, system calls, process spawning |
secrets | Hardcoded credentials, API keys, tokens, passwords |
sql | SQL injection patterns, unsafe query construction |
xss | Cross-site scripting, DOM manipulation, unsafe output |
python | Python-specific dangerous functions |
js | JavaScript security issues |
go | Go language security issues |
php | PHP security flaws |
c | C/C++ dangerous patterns |
ruby | Ruby security patterns |
dotnet | .NET/C# security issues |
default | General security patterns |
| Pattern | Database | Threat |
|---|---|---|
socket.connect, /dev/tcp/ | exec | Reverse shell |
base64.b64decode, eval(atob()) | exec | Obfuscation |
curl + encoded data | exec | Data exfiltration |
crontab, startup scripts | exec | Persistence |
/etc/passwd, keychain | secrets | Credential theft |
| API keys, tokens | secrets | Exposed credentials |
Output format: filename:line_number:matched_line
| Pattern Type | Typical Severity | Action |
|---|---|---|
secrets (real credentials) | CRITICAL | Immediate rotation |
exec with user input | CRITICAL | Code remediation |
sql string concatenation | HIGH | Parameterize queries |
xss innerHTML | HIGH | Sanitize output |
Generic default | VARIABLE | Manual review |