mcpbeat Sign in

Security Audit Skill for Claude

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

513 tokens
context cost
the whole folder, loaded on every use
1
files
instructions only
0
copies elsewhere
how many repositories repackaged it
722
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository
npx skills add https://github.com/laolaoshiren/claude-code-skills-zh --skill security-audit

The instruction itself

as written by the author

代码安全审计

触发条件

当用户要求安全检查、漏洞扫描、安全审计、依赖安全检查时激活此技能。

工作流程

  • 确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
  • 静态安全扫描 — 按检查清单逐项排查
  • 依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
  • 生成审计报告 — 按严重程度分类输出

检查清单

🔴 高危

  • [ ] 硬编码密钥/密码/API Key
  • [ ] SQL 注入风险(字符串拼接 SQL)
  • [ ] 命令注入(未过滤的 shell 命令)
  • [ ] 路径遍历(未校验的文件路径)
  • [ ] 反序列化漏洞
  • [ ] 未校验的 JWT/Token 验证

🟡 中危

  • [ ] XSS 风险(未转义的用户输入)
  • [ ] CSRF 保护缺失
  • [ ] 不安全的随机数生成
  • [ ] 敏感信息日志泄露
  • [ ] 过宽的权限设置
  • [ ] 缺少 Rate Limiting

🟢 低危

  • [ ] 缺少输入验证
  • [ ] 依赖版本过旧
  • [ ] 缺少安全头部(CSP, HSTS, X-Frame-Options)
  • [ ] 错误信息泄露内部细节
  • [ ] 缺少 HTTPS 强制

输出格式

## 🔒 安全审计报告

### 审计概览
- 审计范围:xxx
- 发现问题:🔴 高危 X 个 / 🟡 中危 X 个 / 🟢 低危 X 个

### 🔴 高危问题
#### 1. [文件路径:行号]
- **漏洞类型**:xxx
- **风险描述**:xxx
- **攻击场景**:攻击者可以通过 xxx 方式...
- **修复方案**:

// 修复前

// 修复后


### 🟡 中危问题
...

### 🟢 低危问题
...

### 依赖安全
| 依赖名 | 当前版本 | 建议版本 | 风险 |
|--------|---------|---------|------|

### 修复优先级建议
1. 立即修复:...
2. 本周修复:...
3. 长期改进:...

注意事项

  • 提供修复前后的代码对比
  • 对于每条漏洞,说明具体的攻击向量
  • 优先级基于可利用性和影响范围判断

Other skills for the same job

different authors, same section of the catalogue
Backend Security Coder
by ComeOnOliver
×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens
Cloud Penetration Testing
by ComeOnOliver
×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens
Codebase Cleanup Deps Audit
by ComeOnOliver
×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

10k tokens
Flow Nexus Platform
by ComeOnOliver
×2

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens
Linux Privilege Escalation
by ComeOnOliver
×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

8k tokens
Malware Analyst
by ComeOnOliver
×2

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

4k tokens
Metasploit Framework
by ComeOnOliver
×2

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens
Mobile Security Coder
by ComeOnOliver
×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take laolaoshiren/security-audit from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.