跳到正文
cccskills
免费在 GitHub 公开

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(2)

  • SKILL.md2.2 KB
  • references/sast-review-checklist.md312 B

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Source Code Security Audit

ACTION REQUIRED(读完后立刻执行)

  1. NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权
  2. NOW: 确认有源码/仓库访问(无源码二进制 → 转 RE skill)
  3. NOW: 明确语言栈与范围(目录/服务/PR diff)
  4. NEXT: tool-index;semgrep 等
  5. ACT: 威胁建模草图 → 自动扫描 → 人工验证

适用场景

  • 白盒审计、PR/差分安全审查
  • Semgrep / CodeQL / Bandit / gosec 等 SAST
  • 危险 API、注入点、鉴权缺失、加密误用
  • 与 supply-chain-security/ 分工:本 skill 偏自有代码逻辑,供应链偏依赖与管道

工作流

1. 范围与威胁模型

□ 信任边界:用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产:鉴权、支付、管理端、密钥处理

2. 自动扫描

semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .

3. 人工验证(MUST)

□ 每个 SAST 命中:可达性?可利用性?误报?
□ 鉴权:IDOR/越权、缺校验、错误的多租户隔离
□ 注入:SQL/命令/模板/LDAP
□ 加密:硬编码密钥、ECB、自定义 crypto

4. 产出

Finding:位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号

工具链

工具语言/场景
Semgrep多语言快速规则
CodeQL深数据流(GitHub)
BanditPython
gosec / staticcheckGo
SpotBugs / FindSecBugsJava

参考

  • references/sast-review-checklist.md
  • ../supply-chain-security/ ../api-security/ ../llm-security/(Agent 代码)

路由上下文

上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain;运行时验证 → pentest-tools

任务完成自检

  • 是否人工验证而非只贴扫描器输出?
  • 是否含修复建议?
  • 是否限定在授权仓库范围?
  • Checklist?

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Use this skill whenever the user wants to create or improve a presentation for an academic context — conference papers, seminar talks, thesis defenses, grant briefings, lab meetings, invited lectures, or any presentation where the audience will evaluate reasoning and evidence. Triggers include: 'conference talk', 'seminar slides', 'thesis defense', 'research presentation', 'academic deck', 'academic presentation'. Also triggers when the user asks to 'make slides' in combination with academic content (e.g., 'make slides for my paper on X', 'create a presentation for my dissertation defense', 'build a deck for my grant proposal'). This skill governs CONTENT and STRUCTURE decisions. For the technical work of creating or editing the .pptx file itself, also read the pptx SKILL.md.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

adp

免费

Redpanda's Agentic Data Plane: governance infrastructure for building, running, and governing AI agents and MCP servers, plus a proxying AI Gateway for LLM providers, operated via `rpk ai` and the ADP API. Use when creating or managing AI agents (managed or self-managed) via `rpk ai agent` or `AgentRegistryService`; configuring MCP servers (remote or managed catalog, code mode, auth); setting up LLM providers or querying models via `rpk ai llm`/`rpk ai model` or the AI Gateway proxy; or configuring budgets, guardrails, or Cedar access-control policies through the governance APIs. Also covers reading agent transcripts and spending insights, and wiring OAuth clients or providers to the aigw Authorization Server. For the separate rpk cloud mcp control-plane MCP server, see `/redpanda:rpk-cloud`.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

ads

免费

Operate professional paid advertising across Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, Apple, Amazon, Reddit, Pinterest, Snapchat, and X. Use for account intake, source-grounded audits, strategy, budget and measurement planning, creative production, experiments, reporting, monitoring, and explicitly approved campaign changes. Also trigger on PPC, paid social, retail media, attribution, tracking, landing pages, cross-platform conversion totals, negative keywords or search terms, beta-feature scoring, stale platform claims, API-token or credential setup, campaign deletion, and safe Claude Ads installation or uninstall.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

ads-apple

免费

Audit Apple Ads measurement, AdServices and AdAttributionKit, campaign and keyword structure, Search Match, App Store placements, custom product pages, bidding, budgets, MMP reconciliation, and policy. Use for Apple Ads, Apple Search Ads, App Store ads, Search Match, custom product pages, AdServices, or Apple app-install campaigns.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

Research competitor paid-ad presence, messaging, creative, formats, landing pages, keyword and auction signals, transparent ad libraries, and strategic gaps across supported platforms. Use for competitor ads, ad libraries, ad spy, competitive PPC analysis, competitor creative, Google Ads Transparency, Meta Ad Library, or paid-media competitor research.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

ads-dna

免费

Extract a public-safe brand and offer profile for paid advertising from an authorized website and operator input. Triggers on: brand DNA, brand profile, brand identity, brand style, brand colors, brand voice, visual identity, style guide, website brand analysis.

中文简介正在准备中。当前显示原文说明。

skillmds/skillmd2492026年10月14日 更新

查看 skillmds 的全部技能

报告此技能的问题