cyberaudit-skill 3.0.0

package/README.md

@@ -0,0 +1,77 @@
+# CyberAudit Skill
+
+**Universal security audit skill for AI agents.**  
+One install. Any AI agent. Full OWASP coverage.
+
+```bash
+npx -y cyberaudit-skill install
+```
+
+## What It Is
+
+CyberAudit is a structured security audit framework delivered as an AI agent skill. It covers OWASP Top 10 (web), OWASP MASVS (mobile), API security, and cloud config — with scoring, severity ratings, and remediation guidance.
+
+Supports every major AI coding agent:
+
+| Agent | Detection | Method |
+|---|---|---|
+| OpenCode | `~/.agents/skills/` | File copy |
+| Claude Code | `~/.claude/skills/` | File copy |
+| Cursor | `.cursor/mcp.json` | MCP server |
+| Kiro | `~/.kiro/skills/` | File copy |
+| Gemini | `~/.gemini/skills/` | File copy |
+
+## Quick Start
+
+```bash
+# Auto-detect & install for all found agents
+npx -y cyberaudit-skill install
+
+# Install for a specific agent
+npx -y cyberaudit-skill install --agent opencode
+
+# Preview without making changes
+npx -y cyberaudit-skill install --dry-run
+```
+
+## Available Audits
+
+| Command | Scope |
+|---|---|
+| `cyberaudit-web` | OWASP Top 10 web app audit |
+| `cyberaudit-mobile` | OWASP MASVS mobile audit |
+| `cyberaudit-api` | API security audit |
+| `cyberaudit-cloud` | Cloud config audit |
+| `cyberaudit-full` | Full stack (web + API + cloud) |
+| `cyberaudit-quick` | 5-minute vulnerability scan |
+
+### Usage
+
+Once installed, load the skill in your AI agent:
+
+```
+/load-skill cyberaudit
+/cyberaudit-web example.com
+```
+
+## MCP Server
+
+CyberAudit runs as a stdio MCP server for MCP-compatible agents (Cursor, etc.):
+
+```bash
+npx -y cyberaudit-skill serve
+```
+
+## Verify Installation
+
+```bash
+npx -y cyberaudit-skill list
+```
+
+## Repository
+
+https://github.com/ArisRoman/cyberaudit-skill
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { existsSync, mkdirSync, cpSync, readdirSync, writeFileSync, readFileSync } from "fs";
+import { createInterface } from "readline";
+import { homedir } from "os";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(__dirname, "..");
+const SKILL_SRC = join(PKG_ROOT, "skills", "cyberaudit");
+const AGENT_TARGETS = {
+    "opencode": [join(homedir(), ".agents", "skills", "cyberaudit")],
+    "claude-code": [join(homedir(), ".claude", "skills", "cyberaudit")],
+    "kiro": [join(homedir(), ".kiro", "skills", "cyberaudit")],
+    "cursor": [join(homedir(), ".cursor", "mcp.json")],
+    "gemini": [join(homedir(), ".gemini", "skills", "cyberaudit")],
+};
+function detectInstalledAgents() {
+    const found = [];
+    for (const [agent, paths] of Object.entries(AGENT_TARGETS)) {
+        if (agent === "cursor" || agent === "gemini")
+            continue;
+        if (paths.some((p) => existsSync(dirname(p)))) {
+            found.push(agent);
+        }
+    }
+    if (existsSync(join(homedir(), ".cursor")))
+        found.push("cursor");
+    if (existsSync(join(homedir(), ".gemini")))
+        found.push("gemini");
+    return found;
+}
+function installSkill(targetDir, dryRun) {
+    if (!existsSync(SKILL_SRC)) {
+        console.error(`✗ Skill source not found at ${SKILL_SRC}.`);
+        return false;
+    }
+    if (existsSync(targetDir) && readdirSync(targetDir).length > 0) {
+        console.log(`  ✓ Already installed at ${targetDir}`);
+        return true;
+    }
+    if (dryRun) {
+        console.log(`  → Would install to ${targetDir} (--dry-run)`);
+        return true;
+    }
+    mkdirSync(targetDir, { recursive: true });
+    cpSync(SKILL_SRC, targetDir, { recursive: true });
+    console.log(`  ✓ Installed at ${targetDir} (${readdirSync(targetDir).length} files)`);
+    return true;
+}
+function installForCursor(dryRun) {
+    const cursorDir = join(homedir(), ".cursor");
+    if (!existsSync(cursorDir)) {
+        console.log("  ~ Cursor not found (no ~/.cursor/)");
+        return false;
+    }
+    const mcpPath = join(cursorDir, "mcp.json");
+    let mcpConfig = { mcpServers: {} };
+    if (existsSync(mcpPath)) {
+        mcpConfig = JSON.parse(readFileSync(mcpPath, "utf-8"));
+    }
+    if (mcpConfig.mcpServers?.["cyberaudit-skill"]) {
+        console.log(`  ✓ Cursor MCP already configured`);
+        return true;
+    }
+    if (dryRun) {
+        console.log(`  → Would add Cursor MCP entry to ${mcpPath}`);
+        return true;
+    }
+    mcpConfig.mcpServers = mcpConfig.mcpServers || {};
+    mcpConfig.mcpServers["cyberaudit-skill"] = {
+        command: "npx",
+        args: ["-y", "cyberaudit-skill", "serve"],
+    };
+    writeFileSync(mcpPath, JSON.stringify(mcpConfig, null, 2));
+    console.log(`  ✓ Added Cursor MCP entry to ${mcpPath}`);
+    return true;
+}
+function installForAgent(agent, dryRun) {
+    switch (agent) {
+        case "cursor":
+            return installForCursor(dryRun);
+        default: {
+            const paths = AGENT_TARGETS[agent];
+            if (!paths?.length)
+                return false;
+            return installSkill(paths[0], dryRun);
+        }
+    }
+}
+async function main() {
+    const program = new Command();
+    program
+        .name("cyberaudit-skill")
+        .description("CyberAudit Skill — universal security audit skill for AI agents")
+        .version("3.0.0");
+    program
+        .command("install")
+        .description("Install CyberAudit Skill for AI agent(s)")
+        .option("-a, --agent <agent>", "Target: opencode, claude-code, kiro, cursor, gemini, or all", "all")
+        .option("--dry-run", "Show changes without applying", false)
+        .action((options) => {
+        const dryRun = !!options.dryRun;
+        const agentOpt = (options.agent || "all").toLowerCase();
+        let agents;
+        if (agentOpt === "all") {
+            agents = detectInstalledAgents();
+            if (agents.length === 0) {
+                console.log("No supported AI agents detected.\nTry: --agent opencode");
+                process.exit(1);
+            }
+        }
+        else {
+            const valid = ["opencode", "claude-code", "kiro", "cursor", "gemini"];
+            if (!valid.includes(agentOpt)) {
+                console.error(`Unknown agent: "${agentOpt}". Valid: ${valid.join(", ")}`);
+                process.exit(1);
+            }
+            agents = [agentOpt];
+        }
+        const label = dryRun ? " (dry run)" : "";
+        console.log(`\n═══ CyberAudit Installation${label} ═══\n`);
+        let ok = 0, fail = 0;
+        for (const agent of agents) {
+            const name = agent.charAt(0).toUpperCase() + agent.slice(1);
+            if (installForAgent(agent, dryRun))
+                ok++;
+            else
+                fail++;
+        }
+        console.log(`\nDone. ${ok} configured, ${fail} skipped.\n`);
+        if (!dryRun)
+            console.log("Verify: cyberaudit-skill list\n");
+    });
+    program
+        .command("list")
+        .description("List audits and installed agents")
+        .action(() => {
+        console.log("\n═══ CyberAudit — Available Audits ═══\n");
+        console.log("  cyberaudit-web       OWASP web app security audit");
+        console.log("  cyberaudit-mobile    OWASP mobile app security audit");
+        console.log("  cyberaudit-api       API security audit");
+        console.log("  cyberaudit-cloud     Cloud config audit");
+        console.log("  cyberaudit-full      Full stack (web + API + cloud)");
+        console.log("  cyberaudit-quick     Quick vulnerability scan\n");
+        console.log("═══ Installed Agents ═══\n");
+        for (const [agent] of Object.entries(AGENT_TARGETS)) {
+            if (agent === "cursor") {
+                const mcpPath = join(homedir(), ".cursor", "mcp.json");
+                const ok = existsSync(mcpPath) && readFileSync(mcpPath, "utf-8").includes("cyberaudit-skill");
+                console.log(`  ${ok ? "✓" : "✗"} ${agent}`);
+            }
+            else {
+                const paths = AGENT_TARGETS[agent];
+                const ok = paths.some((p) => existsSync(p));
+                console.log(`  ${ok ? "✓" : "✗"} ${agent}`);
+            }
+        }
+        console.log();
+    });
+    program
+        .command("serve")
+        .description("Start CyberAudit MCP server (stdio)")
+        .action(() => {
+        console.error("[CyberAudit] MCP server starting...");
+        startMcpServer();
+    });
+    program.parse(process.argv);
+}
+function startMcpServer() {
+    const rl = createInterface({ input: process.stdin });
+    const capabilities = {
+        tools: [
+            {
+                name: "cyberaudit-web",
+                description: "Web app security audit (OWASP Top 10)",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        target: { type: "string", description: "URL or project path" },
+                        depth: { type: "string", enum: ["quick", "standard", "deep"], default: "standard" },
+                    },
+                },
+            },
+            {
+                name: "cyberaudit-mobile",
+                description: "Mobile app security audit (OWASP MASVS)",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        target: { type: "string", description: "App package or project path" },
+                        platform: { type: "string", enum: ["android", "ios", "both"], default: "both" },
+                    },
+                },
+            },
+            {
+                name: "cyberaudit-api",
+                description: "API security audit",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        target: { type: "string", description: "API endpoint or spec file" },
+                    },
+                },
+            },
+            {
+                name: "cyberaudit-list",
+                description: "List all available audit types",
+                inputSchema: { type: "object", properties: {} },
+            },
+        ],
+    };
+    function write(id, result) {
+        process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id, ...result }) + "\n");
+    }
+    rl.on("line", (line) => {
+        try {
+            const msg = JSON.parse(line.trim());
+            const id = msg.id;
+            if (msg.method === "initialize") {
+                write(id, { protocolVersion: "2024-11-05", capabilities, serverInfo: { name: "cyberaudit-skill", version: "3.0.0" } });
+            }
+            else if (msg.method === "tools/list") {
+                write(id, capabilities);
+            }
+            else if (msg.method === "tools/call") {
+                write(id, {
+                    content: [{ type: "text", text: `[CyberAudit] "${msg.params.name}" called with ${JSON.stringify(msg.params.arguments)}\n\nRun the audit by loading the CyberAudit Skill.` }],
+                });
+            }
+            else {
+                write(id, { error: { code: -32601, message: `Unknown method: ${msg.method}` } });
+            }
+        }
+        catch { /* skip malformed */ }
+    });
+}
+main().catch((err) => {
+    console.error("[CyberAudit] Fatal error:", err);
+    process.exit(1);
+});

package/dist/mcp-server.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/mcp-server.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+import { createInterface } from "readline";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SKILL_DIR = join(__dirname, "..", "skills", "cyberaudit");
+const capabilities = {
+    tools: [
+        {
+            name: "cyberaudit-web",
+            description: "Run a web application security audit (OWASP Top 10)",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: { type: "string", description: "URL, domain, or project path to audit" },
+                    depth: { type: "string", enum: ["quick", "standard", "deep"], default: "standard" },
+                },
+                required: ["target"],
+            },
+        },
+        {
+            name: "cyberaudit-mobile",
+            description: "Run a mobile application security audit (OWASP MASVS)",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: { type: "string", description: "App identifier, APK/IPA path, or project path" },
+                    platform: { type: "string", enum: ["android", "ios", "both"], default: "both" },
+                },
+                required: ["target"],
+            },
+        },
+        {
+            name: "cyberaudit-api",
+            description: "Run an API security audit",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: { type: "string", description: "API base URL, OpenAPI spec path, or project directory" },
+                },
+                required: ["target"],
+            },
+        },
+        {
+            name: "cyberaudit-cloud",
+            description: "Run a cloud configuration security audit",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: { type: "string", description: "Cloud provider or config file path" },
+                },
+                required: ["target"],
+            },
+        },
+        {
+            name: "cyberaudit-quick",
+            description: "Run a quick vulnerability scan (5-minute assessment)",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    target: { type: "string", description: "URL, domain, or project path" },
+                },
+                required: ["target"],
+            },
+        },
+    ],
+};
+function write(id, result) {
+    process.stdout.write(JSON.stringify({ jsonrpc: "2.0", id, ...result }) + "\n");
+}
+function handleToolCall(id, name, args) {
+    const auditType = name.replace("cyberaudit-", "");
+    write(id, {
+        content: [
+            {
+                type: "text",
+                text: `▶ CyberAudit: ${auditType.toUpperCase()} audit requested
+
+Target: ${args.target}
+${args.depth ? `Depth: ${args.depth}` : ""}
+${args.platform ? `Platform: ${args.platform}` : ""}
+
+To execute the full audit, load the CyberAudit Skill and run:
+
+/${name} "${args.target}"
+
+The skill will guide you through all checks, scoring, and report generation.
+
+Skill location: ${SKILL_DIR}`,
+            },
+        ],
+    });
+}
+const rl = createInterface({ input: process.stdin });
+rl.on("line", (line) => {
+    try {
+        const msg = JSON.parse(line.trim());
+        const id = msg.id;
+        switch (msg.method) {
+            case "initialize":
+                write(id, {
+                    protocolVersion: "2024-11-05",
+                    capabilities,
+                    serverInfo: { name: "cyberaudit-skill", version: "3.0.0" },
+                });
+                break;
+            case "tools/list":
+                write(id, capabilities);
+                break;
+            case "tools/call":
+                handleToolCall(id, msg.params.name, msg.params.arguments || {});
+                break;
+            case "notifications/initialized":
+                // no response expected
+                break;
+            default:
+                write(id, { error: { code: -32601, message: `Method not found: ${msg.method}` } });
+        }
+    }
+    catch (e) {
+        // ignore malformed input
+    }
+});
+process.on("SIGINT", () => process.exit(0));
+process.on("SIGTERM", () => process.exit(0));
+console.error(`[CyberAudit] MCP server ready | Skill: ${SKILL_DIR}`);

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "cyberaudit-skill",
+  "version": "3.0.0",
+  "description": "Universal security audit skill for AI agents. Install once, audit any web or mobile app. OpenCode, Claude Code, Cursor, Kiro, Gemini — all supported.",
+  "keywords": [
+    "mcp",
+    "security",
+    "audit",
+    "cybersecurity",
+    "owasp",
+    "pentest",
+    "skill",
+    "ai-agent",
+    "opencode",
+    "claude-code",
+    "cursor"
+  ],
+  "author": "ArisRoman",
+  "license": "MIT",
+  "homepage": "https://github.com/ArisRoman/cyberaudit-skill",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ArisRoman/cyberaudit-skill.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ArisRoman/cyberaudit-skill/issues"
+  },
+  "type": "module",
+  "main": "dist/cli.js",
+  "bin": {
+    "cyberaudit-skill": "dist/cli.js"
+  },
+  "files": [
+    "dist/",
+    "skills/"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/cli.js",
+    "dev": "tsx src/cli.ts",
+    "install:local": "node dist/cli.js install",
+    "install:all": "node dist/cli.js install --agent all",
+    "serve": "tsx src/mcp-server.ts",
+    "prepublishOnly": "npm run build",
+    "postinstall": "node -e \"try{require('fs').accessSync('dist/cli.js');require('child_process').execSync('node dist/cli.js install --agent all 2>/dev/null',{stdio:'inherit'})}catch(e){}\""
+  },
+  "dependencies": {
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/skills/cyberaudit/AGENT-BOOT.md

@@ -0,0 +1,122 @@
+# CYBERAUDIT SKILL — AGENT BOOT SEQUENCE
+Version: 3.0.0 LUNAIRE
+Classification: UNIVERSAL SECURITY INTELLIGENCE
+
+═══════════════════════════════════════════════════════════════
+                    WHO YOU ARE
+═══════════════════════════════════════════════════════════════
+
+You are CyberAudit, a world-class security intelligence.
+You combine the expertise of:
+
+  → An OSCP/OSCE certified professional with 15 years of real pentesting
+  → A senior security architect who worked on critical
+    systems (banking, defense, healthcare)
+  → A vulnerability researcher who has published CVEs
+  → A senior developer mastering every audited framework
+  → A CISO who translates technical issues into business risk
+
+You are NOT an automated scanner.
+You are an expert who THINKS, CONTEXTUALIZES, and PRIORITIZES.
+
+═══════════════════════════════════════════════════════════════
+                    YOUR OATH
+═══════════════════════════════════════════════════════════════
+
+  "I do not search for vulnerabilities to destroy.
+   I search for vulnerabilities to protect.
+   Every flaw I find is a flaw the attacker
+   will not find first."
+
+═══════════════════════════════════════════════════════════════
+                    STARTUP SEQUENCE
+═══════════════════════════════════════════════════════════════
+
+WHEN you receive an audit request, you ALWAYS execute:
+
+STEP 1 — IDENTIFICATION (mandatory, 30 mental seconds)
+  ┌─────────────────────────────────────────────┐
+  │ TYPE ?      → Web / Mobile / Both           │
+  │ FRAMEWORK ? → Identify precisely            │
+  │ CONTEXT ?   → Dev / Staging / Production    │
+  │ SCOPE ?     → Entire code / A module        │
+  │ URGENCY ?   → Full audit / Quick scan       │
+  └─────────────────────────────────────────────┘
+
+STEP 2 — MODE LOADING
+  If Web    → Load WEB-PHILOSOPHY.md + relevant framework
+  If Mobile → Load MOBILE-PHILOSOPHY.md + relevant framework
+  If Both   → Load both philosophies
+
+STEP 3 — STRUCTURED AUDIT
+  Follow the flow defined in the loaded philosophy
+  NEVER skip a phase
+  Document each finding immediately
+
+STEP 4 — REPORT
+  Use the corresponding template
+  CVSS scoring for each finding
+  COMPLETE and mentally TESTED remediation code
+
+═══════════════════════════════════════════════════════════════
+                    YOUR ABSOLUTE RULES
+═══════════════════════════════════════════════════════════════
+
+RULE 1 — ZERO FALSE POSITIVE TOLERATED
+  A finding without code evidence = not a finding
+  Always cite the file, line, exact pattern
+
+RULE 2 — COMPLETE REMEDIATION OR NOTHING
+  A finding without a solution = useless frustration
+  Always provide the fixed code, not just a description
+
+RULE 3 — CONTEXT BEFORE SEVERITY
+  A SQLi in an internal search field ≠ a SQLi on the login
+  Assess real business impact, not just the theoretical score
+
+RULE 4 — THINK LIKE THE ATTACKER
+  For every piece of code you see, ask yourself:
+  "How would a motivated attacker exploit this?"
+
+RULE 5 — PRIORITIZE LIKE A CISO
+  The dev team has limited resources
+  Tell them what to fix FIRST with surgical precision
+
+RULE 6 — NEVER WITHHOLD PARTIAL AUDIT STATUS
+  If you do not have all the code, say so explicitly
+  A partial audit presented as complete is dangerous
+
+═══════════════════════════════════════════════════════════════
+                    AUDIT LEVELS
+═══════════════════════════════════════════════════════════════
+
+  LEVEL 1 — QUICK SCAN (15-30 min)
+    → Exposed secrets
+    → Obvious critical vulnerabilities
+    → Dependencies with critical CVEs
+    → Immediate auth bypass
+    Output: Critical and high findings only
+
+  LEVEL 2 — STANDARD AUDIT (1-2h)
+    → Everything from level 1
+    → Full auth/authz flow analysis
+    → Review of all user inputs
+    → Configuration analysis
+    → Complete dependencies review
+    Output: Full report, all severity levels
+
+  LEVEL 3 — DEEP AUDIT (3-5h)
+    → Everything from level 2
+    → Full threat modeling
+    → Business logic analysis
+    → Attack surface mapping
+    → Architecture review
+    → Complete compliance check
+    Output: Professional audit report + remediation plan
+
+  LEVEL 4 — RED TEAM MODE (on explicit request)
+    → Everything from level 3
+    → Exploitation chains (kill chains)
+    → Realistic attack scenarios
+    → Estimated financial and reputational impact
+    Output: Complete Red Team report