本文へ移動
cccskills
無料GitHub で公開

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

インストール方法を見る

含まれるファイル(2)

  • SKILL.md2.2 KB
  • references/sast-review-checklist.md312 B

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Source Code Security Audit

ACTION REQUIRED(读完后立刻执行)

  1. NOW: 读取 ../field-journal/precedent-pentest.md 或代码审计授权
  2. NOW: 确认有源码/仓库访问(无源码二进制 → 转 RE skill)
  3. NOW: 明确语言栈与范围(目录/服务/PR diff)
  4. NEXT: tool-index;semgrep 等
  5. ACT: 威胁建模草图 → 自动扫描 → 人工验证

适用场景

  • 白盒审计、PR/差分安全审查
  • Semgrep / CodeQL / Bandit / gosec 等 SAST
  • 危险 API、注入点、鉴权缺失、加密误用
  • 与 supply-chain-security/ 分工:本 skill 偏自有代码逻辑,供应链偏依赖与管道

工作流

1. 范围与威胁模型

□ 信任边界:用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产:鉴权、支付、管理端、密钥处理

2. 自动扫描

semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .

3. 人工验证(MUST)

□ 每个 SAST 命中:可达性?可利用性?误报?
□ 鉴权:IDOR/越权、缺校验、错误的多租户隔离
□ 注入:SQL/命令/模板/LDAP
□ 加密:硬编码密钥、ECB、自定义 crypto

4. 产出

Finding:位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号

工具链

工具语言/场景
Semgrep多语言快速规则
CodeQL深数据流(GitHub)
BanditPython
gosec / staticcheckGo
SpotBugs / FindSecBugsJava

参考

  • references/sast-review-checklist.md
  • ../supply-chain-security/ ../api-security/ ../llm-security/(Agent 代码)

路由上下文

上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain;运行时验证 → pentest-tools

任务完成自检

  • 是否人工验证而非只贴扫描器输出?
  • 是否含修复建议?
  • 是否限定在授权仓库范围?
  • Checklist?

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Use this skill whenever the user wants to create or improve a presentation for an academic context — conference papers, seminar talks, thesis defenses, grant briefings, lab meetings, invited lectures, or any presentation where the audience will evaluate reasoning and evidence. Triggers include: 'conference talk', 'seminar slides', 'thesis defense', 'research presentation', 'academic deck', 'academic presentation'. Also triggers when the user asks to 'make slides' in combination with academic content (e.g., 'make slides for my paper on X', 'create a presentation for my dissertation defense', 'build a deck for my grant proposal'). This skill governs CONTENT and STRUCTURE decisions. For the technical work of creating or editing the .pptx file itself, also read the pptx SKILL.md.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

adp

無料

Redpanda's Agentic Data Plane: governance infrastructure for building, running, and governing AI agents and MCP servers, plus a proxying AI Gateway for LLM providers, operated via `rpk ai` and the ADP API. Use when creating or managing AI agents (managed or self-managed) via `rpk ai agent` or `AgentRegistryService`; configuring MCP servers (remote or managed catalog, code mode, auth); setting up LLM providers or querying models via `rpk ai llm`/`rpk ai model` or the AI Gateway proxy; or configuring budgets, guardrails, or Cedar access-control policies through the governance APIs. Also covers reading agent transcripts and spending insights, and wiring OAuth clients or providers to the aigw Authorization Server. For the separate rpk cloud mcp control-plane MCP server, see `/redpanda:rpk-cloud`.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

ads

無料

Operate professional paid advertising across Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, Apple, Amazon, Reddit, Pinterest, Snapchat, and X. Use for account intake, source-grounded audits, strategy, budget and measurement planning, creative production, experiments, reporting, monitoring, and explicitly approved campaign changes. Also trigger on PPC, paid social, retail media, attribution, tracking, landing pages, cross-platform conversion totals, negative keywords or search terms, beta-feature scoring, stale platform claims, API-token or credential setup, campaign deletion, and safe Claude Ads installation or uninstall.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

ads-apple

無料

Audit Apple Ads measurement, AdServices and AdAttributionKit, campaign and keyword structure, Search Match, App Store placements, custom product pages, bidding, budgets, MMP reconciliation, and policy. Use for Apple Ads, Apple Search Ads, App Store ads, Search Match, custom product pages, AdServices, or Apple app-install campaigns.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

Research competitor paid-ad presence, messaging, creative, formats, landing pages, keyword and auction signals, transparent ad libraries, and strategic gaps across supported platforms. Use for competitor ads, ad libraries, ad spy, competitive PPC analysis, competitor creative, Google Ads Transparency, Meta Ad Library, or paid-media competitor research.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

ads-dna

無料

Extract a public-safe brand and offer profile for paid advertising from an authorized website and operator input. Triggers on: brand DNA, brand profile, brand identity, brand style, brand colors, brand voice, visual identity, style guide, website brand analysis.

日本語の概要は準備中です。原文の説明を表示しています。

skillmds/skillmd712026年10月9日 更新

skillmds のスキルをすべて見る

このスキルの問題を報告する