無料GitHub で公開

mk-vulnerability-scanner

Vulnerability analysis: OWASP Top 10, current threat landscape, supply chain security, attack surface mapping, risk prioritization. Use for security audits. NOT for STRIDE/CSO infra audits (mk:cso).

ngocsangyem/MeowKit

インストール方法を見る

含まれるファイル（2）

SKILL.md3.1 KB
references/scanning-methodology.md3.6 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Vulnerability Scanner

Think like an attacker, defend like an expert.

When to Use

Security audit of a project or module
Before shipping code that handles auth, payments, or user data
When asked to "scan for vulnerabilities", "security check", "audit security"
When mk:cso delegates specific scanning tasks

Core Principles

Principle	Application
Assume Breach	Design as if attacker already inside
Zero Trust	Never trust, always verify
Defense in Depth	Multiple layers, no single point
Least Privilege	Minimum required access only
Fail Secure	On error, deny access

Process

Map attack surface — entry points, data flows, trust boundaries, assets
Load scanning methodology — read references/scanning-methodology.md
Reconnaissance — understand technology stack, entry points, data flows
Discovery — configuration review, dependency analysis, code pattern search
Analysis — validate findings, eliminate false positives, score risks
Report — each finding: What, Where, Why, Impact, How to fix

Threat Modeling Questions

Before scanning, ask: What are we protecting? Who would attack? How? What's the impact?

References

Reference	When to load	Content
scanning-methodology.md	Step 2 — executing scan	OWASP Top 10, supply chain, code patterns, risk prioritization, reporting format

Runtime Scripts

Script	Purpose	Usage
`security-scan.py`	Security pattern scanning	`.agents/skills/.venv/bin/python3 .codex/scripts/security-scan.py`
`injection-audit.py`	Prompt injection detection	`.agents/skills/.venv/bin/python3 .codex/scripts/injection-audit.py`

Gotchas

False positives in test fixtures: Security scan flags intentionally insecure test data → Exclude test/fixtures/ and mocks/ from vulnerability scans
Dependency confusion attacks missed: Scanner checks known CVEs but not package name typosquatting → Cross-reference package names against known typosquat databases

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

meowkit-design

無料

Use this skill to generate well-branded interfaces and assets for MeowKit (AI Agent Toolkit for Claude Code), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and UI kit components for prototyping.

日本語の概要は準備中です。原文の説明を表示しています。