菜单
Run browser-based security validations (CSRF, XSS, clickjacking) against containerized labs using Playwright. Separate from validate-findings which targets K8s operators/containers.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user asks for an executive summary, leadership roll-up, or cross-portfolio dashboard of security-audit findings — e.g. "summarise all findings", "how many criticals do we have", "credential leaks across the campaign", "findings by language", or "rebuild the executive summary". Aggregates every *security-audit.{json,md} report under analysis-results/ into a one-page Markdown brief and a self-contained HTML dashboard.
Use when the user asks to generate a shareable findings folder, executive summary, or team-specific security audit report for one or more products from the findings directory.
Use when the user asks to add one or more GitHub/GitLab repositories or an entire GitHub organization to the hybrid-platforms-inputs inventory. Adds entries to the appropriate segment CSV files and generates matching owners.csv rows.
Use when the user provides a previous secure-code-audit report and a patched version of the scanned repository, and asks to verify that findings have been resolved. Performs a targeted re-audit of each original finding against the patched code using the same frameworks, criteria, and evidence standards as the original secure-code-audit, then emits a structured verification report.
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.
Use when the user asks for pitch-deck metrics, funding/leadership talking points, a campaign scoreboard, or to (re)build/refresh progress-tracker/pitch-deck-metrics.md. Deterministically harvests headline numbers from the campaign's derived artifacts (executive summary, validation/fuzz dashboard, threat register, progress-tracker control files) and the harness's own tree/git metadata into one consistently-updatable Markdown scoreboard.
| name | validate-browser-finding |
| description | Run browser-based security validations (CSRF, XSS, clickjacking) against containerized labs using Playwright. Separate from validate-findings which targets K8s operators/containers. |
Browser-native validation using an onion-layer methodology: prove the exploit at the innermost layer (app with simple auth), then progressively add real-world defenses (OAuth, proxy, ingress) to confirm each layer's contribution.
| Layer | What's Running | Proves |
|---|---|---|
| 1 — Bare app | Target + attacker + Playwright. Simple/no auth. | Exploit works when last line of defense is absent |
| 2 — App + auth | Add real login (form, basic, token). | Exploit survives authenticated sessions |
| 3 — App + auth + middleware | Add oauth-proxy, CSRF tokens, SameSite policy. | Which middleware layer actually blocks the attack |
| 4 — Full stack | Add IdP (Keycloak/Dex), TLS, ingress. | Real-world exploitability with production auth flow |
Start at Layer 1. If confirmed, move outward — each layer either blocks the attack (refuted at that layer) or passes it through (confirmed, move to next layer).
| Finding Severity | Required Validation | Infrastructure |
|---|---|---|
| Critical / High | Layer 1-2 (local) + Layer 3-4 (OCP cluster) | docker-compose → deploy to ephemeral OCP in AWS |
| Medium / Low | Layer 1-2 only | docker-compose (Playwright + containers) |
For high/critical findings that confirm at Layer 1-2, deploy the target to OCP:
targets.yaml (origins point to cluster Routes)security-testing-clusters for ephemeral provisioningvalidate-findings or validate-core-ocp reported inconclusive/refuted on HTTP-surface findings due to missing cookie/session round-tripvalidate-findingsvalidate-findings with port-forward+httpAuth strategies supported today:
Not yet supported (Layer 3–4 follow-up):
cd hybrid-platforms-sec/ai-security-harness/harnessing/validate-browser-finding
python run.py <validation-dir> [--destructive] [--out <dir>]
podman compose up -d in the validation directorypip install -r requirements.txt (includes playwright + pyyaml)playwright install chromium (or use remote container)validations/<name>/
├── *-attack-plan.yaml # Steps to execute
├── *-security-audit.json # Source finding (optional)
├── targets.yaml # Scope: origins, credentials, allowed verbs
├── docker-compose.yaml # Lab: app + attacker + playwright
├── exploit-page/ # HTML PoCs
└── artifacts/ # Output: screenshots, HARs, logs
<name>-validation.json — structured report (same schema as validate-findings)validation-audit.jsonl — append-only execution logartifacts/ — screenshots, HAR files, response capturesvalidations/<jira-slug>/ with docker-compose, targets, attack planexploit-page/podman compose up -d && python run.py validations/<jira-slug>/