菜单
STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using ak:autoresearch pattern.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/hoanghd218/ZaloCRM --skill ak-security命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Search library/framework documentation via llms.txt (context7.com). Use for API docs, GitHub repository analysis, technical documentation lookup, latest library features.
Interview-driven advisory skill. Analyzes a prompt or URL (GitHub issue, spec, doc), scouts the codebase, interviews the user one question at a time to reframe the problem into exact requirements and goals, then delivers honest advice: what to do, what to avoid, better alternatives, benefits and trade-offs. Use when the user asks for advice, a second opinion, a sanity check, requirement reframing before committing to a direction, or wants an existing plan or design pressure-tested (grilled) one question at a time.
Browser and desktop automation through the agent-browser CLI. Use for long autonomous browsing, compact page snapshots, screenshots, form filling, login/test flows without real Chrome profile state, scraping, exploratory QA, cloud browsers, Electron apps, Slack automation, and bug hunts.
基于 SOC 职业分类
正在显示 SKILL.md
| name | ak:security |
| description | STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using ak:autoresearch pattern. |
| user-invocable | true |
| when_to_use | Invoke for threat-modeled security audit or auto-fix loops. |
| category | utilities |
| keywords | ["security","STRIDE","OWASP","audit","red-team","penetration-testing","vulnerability-discovery"] |
| argument-hint | <scope glob or 'full'> [--fix] [--red-team] [--iterations N] |
| metadata | {"author":"agentkit","attribution":"Security audit pattern adapted from autoresearch by Udit Goenka (MIT)","license":"MIT","version":"1.0.0"} |
Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the ak:autoresearch guard pattern.
| Mode | Invocation | Behavior |
|---|---|---|
| Audit only | /ak:security <scope> | Scan → categorize → report (one-shot) |
| Red-team discovery | /ak:security <scope> --red-team | Iterate 4 attacker personas → STRIDE/OWASP sweep → report |
| Bounded red-team | /ak:security <scope> --red-team --iterations N | Cap persona discovery to N iterations total |
| Audit + Fix | /ak:security <scope> --fix | Scan → categorize → fix iteratively |
| Red-team + Fix | /ak:security <scope> --red-team --fix | Full persona discovery → fix confirmed Critical/High |
| Bounded fix | /ak:security <scope> --fix --iterations N | Limit fix iterations to N |
Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.
Evaluate each threat category systematically:
Map findings to OWASP categories (A01–A10). See references/stride-owasp-checklist.md for per-category checks.
Run the appropriate package audit tool for the detected stack:
npm auditpip-auditgovulncheckbundle auditScan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See references/stride-owasp-checklist.md → Secret Patterns.
Assign each finding a severity level (see Severity Definitions below).
## Security Audit Report
### Summary
- Files scanned: N
- Findings: X critical, Y high, Z medium, W low, V info
### Findings
| # | Severity | Category | File:Line | Description | Fix Recommendation |
|---|----------|----------|-----------|-------------|-------------------|
| 1 | Critical | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
| 2 | High | Auth | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
When --red-team is provided, the audit runs a multi-persona iterative discovery loop before (or instead of) the standard one-shot STRIDE/OWASP sweep. Each persona represents a distinct attacker mindset with its own threat model and probe targets.
Each persona phase follows the autoresearch iteration protocol:
security-audit-results.tsv with persona columnAfter all 4 personas complete, a standard STRIDE/OWASP sweep fills remaining coverage gaps.
See
references/red-team-personas.mdfor the full persona catalog: threat models, typical attack vectors, and per-persona probe checklists.
All findings across every persona MUST mask secret values before logging. Never emit raw JWTs (eyJ...), 32+ char hex strings, AWS key prefixes (AKIA, ASIA), or connection strings with embedded passwords. Use <REDACTED_TOKEN>, <REDACTED_PASSWORD>, or reference the env var name only.
When --fix is provided, apply fixes iteratively after the audit:
security(fix-N): <short description>
d. Advance to next findingak:autoresearch guard pattern for regression preventionTip: Use
--iterations Nto cap total fix iterations when scope is large.
| Severity | Description | Fix Priority |
|---|---|---|
| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
| High | Exploitable with moderate effort, significant impact | This sprint |
| Medium | Limited exploitability or impact | Next sprint |
| Low | Theoretical risk, defense-in-depth improvement | Backlog |
| Info | Best practice suggestion, no direct risk | Optional |
ak:predict when the security persona flags concernsak:autoresearch --fix for automated remediationak:scenario with --focus authorization for deeper auth flow testingak:plan to schedule Medium/Low findings as sprint tasks# One-shot audit — API layer only
/ak:security src/api/**/*.ts
# Red-team discovery — full codebase, all 4 personas
/ak:security full --red-team
# Red-team discovery — bounded to 20 iterations total
/ak:security src/ --red-team --iterations 20
# Red-team discovery + auto-fix confirmed Critical/High
/ak:security full --red-team --fix
# One-shot audit + auto-fix, max 15 iterations
/ak:security src/ --fix --iterations 15
See references/stride-owasp-checklist.md for the detailed per-category checklist and secret detection regex patterns.
See references/red-team-personas.md for the full persona catalog: threat models, attack vectors, probe checklists, discovery loop integration, and TSV schema extension for --red-team mode.
Faithful absorption (in scope) of upstream /autoresearch:security (uditgoenka/autoresearch, MIT). The local version supports both one-shot STRIDE + OWASP audit and the red-team-personas iterative discovery loop (closed in #730).
See /ak:autoresearch for the full family map.