免费在 GitHub 公开

mk:vulnerability-scanner

Advanced vulnerability analysis principles. OWASP Top 10 baseline + current threat landscape awareness, Supply Chain Security, attack surface mapping, risk prioritization. Use when performing security audits, threat modeling, or OWASP reviews. NOT for STRIDE/CSO-mode infrastructure audits (see mk:cso).

中文简介正在准备中。当前显示原文说明。

ngocsangyem/MeowKit

查看安装方法

包含的文件（2）

SKILL.md3.6 KB
references/scanning-methodology.md3.6 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Vulnerability Scanner

Think like an attacker, defend like an expert.

When to Use

Security audit of a project or module
Before shipping code that handles auth, payments, or user data
When asked to "scan for vulnerabilities", "security check", "audit security"
When mk:cso delegates specific scanning tasks

Core Principles

Principle	Application
Assume Breach	Design as if attacker already inside
Zero Trust	Never trust, always verify
Defense in Depth	Multiple layers, no single point
Least Privilege	Minimum required access only
Fail Secure	On error, deny access

Process

Map attack surface — entry points, data flows, trust boundaries, assets
Load scanning methodology — read references/scanning-methodology.md
Reconnaissance — understand technology stack, entry points, data flows
Discovery — configuration review, dependency analysis, code pattern search
Analysis — validate findings, eliminate false positives, score risks
Report — each finding: What, Where, Why, Impact, How to fix

Threat Modeling Questions

Before scanning, ask: What are we protecting? Who would attack? How? What's the impact?

References

Reference	When to load	Content
scanning-methodology.md	Step 2 — executing scan	OWASP Top 10, supply chain, code patterns, risk prioritization, reporting format

Runtime Scripts

Script	Purpose	Usage
`security-scan.py`	Security pattern scanning	`.claude/skills/.venv/bin/python3 .claude/scripts/security-scan.py`
`injection-audit.py`	Prompt injection detection	`.claude/skills/.venv/bin/python3 .claude/scripts/injection-audit.py`

Gotchas

False positives in test fixtures: Security scan flags intentionally insecure test data → Exclude test/fixtures/ and mocks/ from vulnerability scans
Dependency confusion attacks missed: Scanner checks known CVEs but not package name typosquatting → Cross-reference package names against known typosquat databases

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

meowkit-design

免费

Use this skill to generate well-branded interfaces and assets for MeowKit (AI Agent Toolkit for Claude Code), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and UI kit components for prototyping.

中文简介正在准备中。当前显示原文说明。