菜单
Security audit with OWASP top 10 checklist, dependency scanning, secrets detection, input validation, and injection prevention. Use when auditing code security, reviewing auth implementations, handling user input, or hardening applications.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-audit |
| description | Security audit with OWASP top 10 checklist, dependency scanning, secrets detection, input validation, and injection prevention. Use when auditing code security, reviewing auth implementations, handling user input, or hardening applications. |
| metadata | {"version":"1.0"} |
| allowed-tools | Bash Grep Read |
Security concern → What type?
├─ Reviewing code changes → OWASP checklist below
├─ Handling user input → Where does it go?
│ ├─ Database query → Parameterized queries (see references/injection-patterns.md)
│ ├─ HTML output → Framework escaping (see references/injection-patterns.md)
│ ├─ Shell command → Array arguments (see references/injection-patterns.md)
│ ├─ File path → Resolve + verify within allowed dir
│ └─ URL redirect → Allowlist or relative paths only
├─ Auditing dependencies → Run scanning commands below
└─ Full security audit → All phases below
Phase 1: Scan → Phase 2: Analyze → Phase 3: Report
| # | Vulnerability | Check |
|---|---|---|
| A01 | Broken Access Control | Auth on every endpoint, RBAC server-side, no IDOR |
| A02 | Cryptographic Failures | TLS everywhere, no MD5/SHA1 for passwords, secrets in env not code |
| A03 | Injection | Parameterized queries, no string concat for SQL/shell/HTML |
| A04 | Insecure Design | Rate limiting, account lockout, input size limits |
| A05 | Security Misconfiguration | No default creds, errors don't leak internals, CORS restricted |
| A06 | Vulnerable Components | Deps updated, no known CVEs, lockfile committed |
| A07 | Auth Failures | Strong passwords, MFA available, session timeout |
| A08 | Data Integrity | Signed updates, CI/CD secured, no untrusted deserialization |
| A09 | Logging Failures | Auth events logged, no sensitive data in logs |
| A10 | SSRF | URL validation, allowlists for external calls |
# Dependency vulnerabilities
npm audit # Node
pip-audit # Python (pip install pip-audit)
# Secret detection
gitleaks detect --source .
# Static analysis
semgrep --config auto . # Multi-language
bandit -r . # Python
| Input | Validate |
|---|---|
| Strings | Max length, allowed characters, trim whitespace |
| Numbers | Min/max range, integer vs float, NaN check |
| Format + domain check (not just regex) | |
| URLs | Protocol allowlist (http/https only), no internal IPs |
| File uploads | Extension allowlist, MIME check, size limit |
| JSON body | Schema validation (zod, joi, pydantic) |
| IDs | Format check (UUID format, positive integer) |
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
[CRITICAL|HIGH|MEDIUM|LOW] Category - Finding
Location: file:line
Impact: What an attacker could do
Fix: Specific remediation
Web accessibility checklist covering WCAG guidelines, ARIA patterns, keyboard navigation, color contrast, screen reader support, and form accessibility. Use when building UI components, reviewing frontend code, or when accessibility is mentioned.
When to refactor vs leave alone, code smell detection, safe refactoring steps, and common transformation patterns. Use when asked to refactor code, clean up technical debt, or when reviewing code that shows structural problems.
Authentication and authorization patterns including JWT vs sessions, OAuth flows, token refresh, RBAC, and password handling. Use when implementing login, signup, token management, role-based access, or reviewing auth security.
Structured research methodology with scoping, multi-source collection, triangulation, source credibility scoring, and anti-hallucination guards. Use when investigating technologies, comparing tools, evaluating libraries, exploring unfamiliar codebases, or producing research reports.
Build MCP (Model Context Protocol) servers in TypeScript or Python. Use when creating custom tools, resources, or prompts that extend AI assistant capabilities via MCP.
Structured logging patterns, log levels, trace IDs, and what to log vs what never to log. Use when setting up logging, choosing log levels, implementing request tracing, or reviewing log output quality.