Skip to content
cccskills
FreePublished on GitHub

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

The English summary is being prepared. Showing the original description.

See how to install

Files included (2)

  • SKILL.md2.2 KB
  • references/sast-review-checklist.md312 B

SKILL.md (original)

Review the instructions the agent will receive before you install.

Source Code Security Audit

ACTION REQUIRED(读完后立刻执行)

  1. NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权
  2. NOW: 确认有源码/仓库访问(无源码二进制 → 转 RE skill)
  3. NOW: 明确语言栈与范围(目录/服务/PR diff)
  4. NEXT: tool-index;semgrep 等
  5. ACT: 威胁建模草图 → 自动扫描 → 人工验证

适用场景

  • 白盒审计、PR/差分安全审查
  • Semgrep / CodeQL / Bandit / gosec 等 SAST
  • 危险 API、注入点、鉴权缺失、加密误用
  • 与 supply-chain-security/ 分工:本 skill 偏自有代码逻辑,供应链偏依赖与管道

工作流

1. 范围与威胁模型

□ 信任边界:用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产:鉴权、支付、管理端、密钥处理

2. 自动扫描

semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .

3. 人工验证(MUST)

□ 每个 SAST 命中:可达性?可利用性?误报?
□ 鉴权:IDOR/越权、缺校验、错误的多租户隔离
□ 注入:SQL/命令/模板/LDAP
□ 加密:硬编码密钥、ECB、自定义 crypto

4. 产出

Finding:位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号

工具链

工具语言/场景
Semgrep多语言快速规则
CodeQL深数据流(GitHub)
BanditPython
gosec / staticcheckGo
SpotBugs / FindSecBugsJava

参考

  • references/sast-review-checklist.md
  • ../supply-chain-security/ ../api-security/ ../llm-security/(Agent 代码)

路由上下文

上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain;运行时验证 → pentest-tools

任务完成自检

  • 是否人工验证而非只贴扫描器输出?
  • 是否含修复建议?
  • 是否限定在授权仓库范围?
  • Checklist?

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Use this skill whenever the user wants to create or improve a presentation for an academic context — conference papers, seminar talks, thesis defenses, grant briefings, lab meetings, invited lectures, or any presentation where the audience will evaluate reasoning and evidence. Triggers include: 'conference talk', 'seminar slides', 'thesis defense', 'research presentation', 'academic deck', 'academic presentation'. Also triggers when the user asks to 'make slides' in combination with academic content (e.g., 'make slides for my paper on X', 'create a presentation for my dissertation defense', 'build a deck for my grant proposal'). This skill governs CONTENT and STRUCTURE decisions. For the technical work of creating or editing the .pptx file itself, also read the pptx SKILL.md.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

adp

Free

Redpanda's Agentic Data Plane: governance infrastructure for building, running, and governing AI agents and MCP servers, plus a proxying AI Gateway for LLM providers, operated via `rpk ai` and the ADP API. Use when creating or managing AI agents (managed or self-managed) via `rpk ai agent` or `AgentRegistryService`; configuring MCP servers (remote or managed catalog, code mode, auth); setting up LLM providers or querying models via `rpk ai llm`/`rpk ai model` or the AI Gateway proxy; or configuring budgets, guardrails, or Cedar access-control policies through the governance APIs. Also covers reading agent transcripts and spending insights, and wiring OAuth clients or providers to the aigw Authorization Server. For the separate rpk cloud mcp control-plane MCP server, see `/redpanda:rpk-cloud`.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

ads

Free

Operate professional paid advertising across Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, Apple, Amazon, Reddit, Pinterest, Snapchat, and X. Use for account intake, source-grounded audits, strategy, budget and measurement planning, creative production, experiments, reporting, monitoring, and explicitly approved campaign changes. Also trigger on PPC, paid social, retail media, attribution, tracking, landing pages, cross-platform conversion totals, negative keywords or search terms, beta-feature scoring, stale platform claims, API-token or credential setup, campaign deletion, and safe Claude Ads installation or uninstall.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

Audit Apple Ads measurement, AdServices and AdAttributionKit, campaign and keyword structure, Search Match, App Store placements, custom product pages, bidding, budgets, MMP reconciliation, and policy. Use for Apple Ads, Apple Search Ads, App Store ads, Search Match, custom product pages, AdServices, or Apple app-install campaigns.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

Research competitor paid-ad presence, messaging, creative, formats, landing pages, keyword and auction signals, transparent ad libraries, and strategic gaps across supported platforms. Use for competitor ads, ad libraries, ad spy, competitive PPC analysis, competitor creative, Google Ads Transparency, Meta Ad Library, or paid-media competitor research.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

Extract a public-safe brand and offer profile for paid advertising from an authorized website and operator input. Triggers on: brand DNA, brand profile, brand identity, brand style, brand colors, brand voice, visual identity, style guide, website brand analysis.

The English summary is being prepared. Showing the original description.

skillmds/skillmd249Updated Oct 14, 2026

See all skills by skillmds

Report a problem with this skill