SuperAPI AI Directory
Partner with us中文AI newsFavorites
SkillsGeek-skills-security-audit

Geek-skills-security-audit

Security & auditing

View repository

Updated 10-16 04:42

About this skill

Security Audit Skill

Comprehensive security audit tool, covering code static analysis (SAST), dynamic testing (DAST), dependency checking (SCA), and server configuration auditing.

Workflow

Security auditing follows these steps:

  1. Environment Detection → Identify project type and technology stack
  2. Dependency Check → Scan third-party library vulnerabilities (highest priority)
  3. Static Code Analysis → SAST scans source code vulnerabilities
  4. Sensitive Information Detection → Scan for hardcoded keys and credentials
  5. Configuration Audit → Check security-related configurations
  6. Generate Report → Summarize findings and provide remediation recommendations

Quick Start

Dependency Installation

# 安装核心Python扫描工具
pip install safety bandit semgrep pip-audit --break-system-packages

# 安装Node.js安全工具（如需要）
npm install -g npm-audit-html retire

One-Click Comprehensive Scan

Run the comprehensive scan script:

python3 /path/to/skill/scripts/full_scan.py /path/to/project

Detection Capabilities

1. Critical Vulnerabilities (Critical)

Vulnerability Type CVE Example Detection Method
React2Shell RCE CVE-2025-55182 Dependency version check
Next.js RCE CVE-2025-66478 Dependency version check
Log4Shell CVE-2021-44228 Dependency version check
SQL Injection CWE-89 SAST + pattern matching
Command Injection CWE-78 SAST + pattern matching

2. OWASP Top 10 2024

  • A01: Broken Access Control - access control flaws
  • A02: Cryptographic Failures - cryptographic failures
  • A03: Injection - injection attacks (SQL/XSS/Command)
  • A04: Insecure Design - insecure design
  • A05: Security Misconfiguration - security misconfiguration
  • A06: Vulnerable Components - vulnerable components
  • A07: Authentication Failures - authentication failures
  • A08: Software Integrity Failures - software integrity failures
  • A09: Logging Failures - logging failures
  • A10: SSRF - Server-Side Request Forgery

Scanning Tool Usage

Python Projects

# Bandit - Python SAST
bandit -r ./src -f json -o bandit_report.json

# Safety - 依赖漏洞检查
safety check --json > safety_report.json

# pip-audit - 依赖审计
pip-audit --format json > pip_audit.json

JavaScript/Node.js Projects

# npm audit - 依赖漏洞
npm audit --json > npm_audit.json

# Retire.js - 检测过时库
retire --js --outputformat json > retire_report.json

# React/Next.js 特别检查（CVE-2025-55182）
npx fix-react2shell-next --check-only

General Detection

# Semgrep - 多语言SAST
semgrep scan --config=auto --json > semgrep_report.json

# Gitleaks - 密钥泄露检测
gitleaks detect --source . --report-format json --report-path gitleaks.json

# Trivy - 容器/依赖扫描
trivy fs --format json --output trivy.json .

Server Security Checks

SSH Configuration Audit

# 检查SSH配置
grep -E "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config

Firewall Status

# UFW状态
sudo ufw status verbose

# iptables规则
sudo iptables -L -n -v

Permission Checks

# 查找SUID文件
find / -perm -4000 -type f 2>/dev/null

# 检查world-writable文件
find / -perm -002 -type f 2>/dev/null

Remediation Recommendations

React2Shell Vulnerability Remediation (CVE-2025-55182)

Affected Versions:

  • React 19.0, 19.1.0, 19.1.1, 19.2.0
  • Next.js ≥14.3.0-canary.77, ≥15, ≥16

Remediation Steps:

# 使用官方修复工具
npx fix-react2shell-next

# 或手动升级
# Next.js 15.x -> 升级到 15.1.4+
# Next.js 14.x -> 降级到稳定14.x版本

Must-Do After Remediation:

  • Rotate all application keys (especially those exposed after December 4, 2024)
  • Check for abnormal processes or network connections

Common Vulnerability Remediation Reference

See references/remediation_guide.md

Report Format

The report generated after the scan is complete includes:

security_report/
├── summary.md           # 执行摘要
├── critical.json        # 高危漏洞
├── dependencies.json    # 依赖漏洞
├── code_issues.json     # 代码问题
├── secrets.json         # 泄露的密钥
└── recommendations.md   # 修复建议

Best Practices

  1. Before each commitRun a quick scan
  2. DailyRun dependency vulnerability checks
  3. WeeklyRun a full security audit
  4. Integrate scanning into the CI/CD pipeline
  5. Subscribe to security advisories (such as CVE, NVD)
  6. Regularly update scanning tools and rule libraries

References

  • Detailed vulnerability detection rules: references/detection_rules.md
  • Remediation guide: references/remediation_guide.md
  • Server hardening: references/server_hardening.md