SuperAPI AI Directory
Partner中文AI newsFavorites
Skillssecurity-audit

security-audit

Security & auditing

View repository

Updated 10-16 08:42

About this skill

Security Audit Skill

Comprehensive security audit tool covering code static analysis (SAST), dependency checks (SCA), and server configuration audit.

Authorization and boundaries (confirm first, then act)

  • Only audit code/servers that the user owns or is explicitly authorized to access; always refuse scanning requests for third-party systems and explain why
  • This skill doesauditing and recommendations, and does not perform active offensive testing (exploit, brute force, DoS verification)
  • When hardcoded credentials are found, only reportlocation and type, and do not echo the full plaintext in the output
  • Unless the user explicitly requests it, do not directly modify business code; provide fixes in the form of recommendations

Timeliness rules (important)

This filedoes not maintain a specific CVE list. For any conclusion about "whether a certain version has vulnerabilities", you must query on the spot: Use web search to look up [框架/库名] CVE advisory [当前年份], or check the official security advisory page. Specific CVEs appearing in the main text (such as Log4Shell CVE-2021-44228) are only used as vulnerabilitycategoryhistorical cases and do not represent the full current threat landscape.

Workflow

Security auditing follows these steps:

  1. Environment detection → identify project type and technology stack
  2. Dependency check → scan third-party library vulnerabilities (highest priority)
  3. Static code analysis → SAST scan source code vulnerabilities
  4. Sensitive information detection → scan hardcoded keys and credentials
  5. Configuration audit → check security-related configurations
  6. Generate report → summarize findings and provide remediation recommendations

Quick start

Dependency installation

# 安装核心Python扫描工具（优先用 venv/pipx，避免污染系统 Python）
pipx install bandit semgrep || pip install safety bandit semgrep pip-audit

# 安装Node.js安全工具（如需要）
npm install -g npm-audit-html retire

One-click comprehensive scan

Run the comprehensive scan script:

python3 /path/to/skill/scripts/full_scan.py /path/to/project

When only a single check is needed, use the standalone script:scripts/dependency_check.py(dependency vulnerabilities only),scripts/secrets_scan.py(sensitive information/keys only, output has been masked for matched values).

Note:dependency_check.py What is built in is anoffline baseline table(it will become outdated), and matched results are marked source: offline-baseline, so you must use pip-audit/npm audit or official advisories for real-time confirmation before drawing conclusions—consistent with the above principle of "not maintaining a CVE list"; the baseline table is a pre-screening tool, not an authoritative source.

Detection capabilities

1. High-risk vulnerabilities (Critical)

Vulnerability type Historical case Detection method
Framework/dependency RCE Log4Shell (CVE-2021-44228) Dependency version check + on-site search for the latest advisory
SQL injection CWE-89 SAST + pattern matching
Command injection CWE-78 SAST + pattern matching

Framework-level RCE keeps emerging (the React/Next.js and other ecosystems have repeatedly had outbreaks in recent years); before checking dependencies, first web search the framework's CVE list for the current year.

2. OWASP Top 10 (subject to the official current version)

At runtime, first perform a web search to confirm the current version (currently the 2025 version); when unable to connect to the internet, use the offline list below as of the time of record, and note in the report that it may be outdated. The following entries are generic category references:

  • A01: Broken Access Control
  • A02: Cryptographic Failures
  • A03: Injection attacks (SQL/XSS/Command)
  • A04: Insecure Design
  • A05: Security Misconfiguration
  • A06: Vulnerable Components
  • A07: Authentication Failures
  • A08: Software Integrity Failures
  • A09: Logging Failures
  • A10: SSRF - Server-Side Request Forgery

Scanner Usage

Python Projects

# Bandit - Python SAST
bandit -r ./src -f json -o bandit_report.json

# Safety - 依赖漏洞检查
safety check --json > safety_report.json

# pip-audit - 依赖审计
pip-audit --format json > pip_audit.json

JavaScript/Node.js Projects

# npm audit - 依赖漏洞
npm audit --json > npm_audit.json

# Retire.js - 检测过时库
retire --js --outputformat json > retire_report.json

Framework-specific checks: first perform a web search to confirm the framework's current high-risk CVEs and official detection tools, then execute (for historical cases see references/remediation_guide.md）。

General Detection

# Semgrep - 多语言SAST
semgrep scan --config=auto --json > semgrep_report.json

# Gitleaks - 密钥泄露检测
gitleaks detect --source . --report-format json --report-path gitleaks.json

# Trivy - 容器/依赖扫描
trivy fs --format json --output trivy.json .

Server Security Checks

SSH Configuration Audit

# 检查SSH配置
grep -E "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config

Firewall Status

# UFW状态
sudo ufw status verbose

# iptables规则
sudo iptables -L -n -v

Permission Checks

# 查找SUID文件
find / -perm -4000 -type f 2>/dev/null

# 检查world-writable文件
find / -perm -002 -type f 2>/dev/null

Remediation Recommendations

General Remediation Workflow for Dependency Vulnerabilities

  1. Check the official advisory: Confirm the affected version range and the official recommended remediation path (upgrade/downgrade/patch tool); do not rely on any version numbers hardcoded in the documentation
  2. Execute remediation: Prefer the official remediation tool; otherwise manually upgrade to the secure version specified in the advisory
  3. Mandatory after remediation(especially for RCE-class vulnerabilities, this must not be skipped):
    • Rotate all application secrets that may have been exposed
    • Check for abnormal processes or network connections (compromise trace investigation)
  4. Regression verification: Re-run the dependency scan to confirm the vulnerability is eliminated

For remediation commands and historical cases of specific vulnerabilities (including the complete React2Shell incident response record), see references/remediation_guide.md。

Report Format

full_scan.py Generate under security_report/ :

security_report/
├── summary.md            # 执行摘要 + 覆盖范围声明（工具缺失时列出缩窄项）
└── security_report.json  # 结构化发现，按 critical/high/medium/low/info 分级 + skipped_tools

secrets_scan.py Separately generate secrets_report.{json,md}(hit values have been redacted). When aggregating findings from multiple sources and splitting files by severity, derive from the severity-level structure of security_report.json ; there is no need to rely on a fixed six-file layout.

Acceptance Criteria (self-check item by item before completion)

  • The report includes summary.md (with a coverage scope statement) and structured JSON; missing scanners are listed in the report
  • Every Critical/High finding has: evidence location (file + line number or configuration item) + impact description + actionable remediation recommendation
  • Dependency vulnerability conclusions are based onthis run's scan or search results, and do not cite outdated built-in CVE knowledge
  • No "confirmed secure"-style conclusions are given — only report "not found within the scope of the checks performed" and list uncovered items
  • For leaked credentials, report only the location and type; no complete plaintext appears in the output

Known Pitfalls

Pitfall Specific Manifestation Countermeasure
Silently skipping when a scanning tool is missing bandit/semgrep cannot be installed in the environment, so it is simply not scanned and no explanation is given Downgrade to grep pattern matching, and in the reportexplicitly state that the coverage scope has narrowed
Treating "scan passed" as "secure" Writing "system is secure" when the tool reports zero findings Tools only cover known patterns; conclusions must be scoped and list unchecked items
--break-system-packages pollute the environment Global pip installation of scanning tools breaks the system Python Prefer venv or pipx; ask for consent first when the user environment is restricted
False positives enter the report unfiltered SAST reports test fixtures and example code as vulnerabilities Manually review the context of each Critical finding, annotate the reason for false positives, then move them out of the critical list

Best Practices

  1. Before each commitrun a quick scan
  2. Dailyrun a dependency vulnerability check
  3. Weeklyrun a full security audit
  4. Integrate scanning into the CI/CD pipeline
  5. Subscribe to security advisories (e.g., CVE, NVD)
  6. Regularly update scanning tools and rule libraries

References

  • Detailed vulnerability detection rules: references/detection_rules.md
  • Remediation guide: references/remediation_guide.md
  • Server hardening: references/server_hardening.md
  • Trigger boundary regression test cases: evals/routing-evals.json(should be rerun after changing this skill's description)