cyberaudit-skill 3.0.0

package/skills/cyberaudit/INSTALL.md

@@ -0,0 +1,311 @@
+# 📦 CYBERAUDIT SKILL — INSTALLATION GUIDE
+# Install the skill once, use it everywhere
+
+═══════════════════════════════════════════════════════════════
+              PREREQUISITES
+═══════════════════════════════════════════════════════════════
+
+  → Git installed on your machine
+  → A compatible AI agent:
+    Cursor, Windsurf, Claude, GPT, Copilot,
+    or any agent that reads Markdown files
+  → Zero dependency. Zero runtime. Zero compilation.
+
+═══════════════════════════════════════════════════════════════
+              INSTALLATION
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+OPTION A — PROJECT-LOCAL (recommended for teams)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  The skill is versioned with your project.
+  All developers get access automatically.
+
+  # In your project root directory
+  git clone https://github.com/yourname/cyberaudit-skill \
+    .skills/cyberaudit
+
+  # Add to .gitignore if you don't want to commit it
+  echo ".skills/" >> .gitignore
+
+  # OR commit the skill with the project (recommended)
+  git add .skills/
+  git commit -m "chore: add cyberaudit security skill"
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+OPTION B — MACHINE-GLOBAL (recommended for solo devs)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  The skill is available across all your projects.
+  Single install, universal use.
+
+  # In your home directory
+  mkdir -p ~/.skills
+  git clone https://github.com/yourname/cyberaudit-skill \
+    ~/.skills/cyberaudit
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+OPTION C — UPDATE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  # Update to the latest version
+  cd .skills/cyberaudit && git pull
+
+  # Or update to a specific version
+  cd .skills/cyberaudit && git checkout v2.0.0
+
+═══════════════════════════════════════════════════════════════
+              PER-AGENT CONFIGURATION
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+CURSOR
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  Cursor automatically reads files in .cursor/rules/
+  Two ways to connect the skill:
+
+  WAY 1 — Symlink (recommended)
+    # Point the skill straight to .cursor/rules/
+    ln -s .skills/cyberaudit .cursor/rules/cyberaudit
+
+  WAY 2 — Boot file copy
+    # Create a Cursor rules file that loads the skill
+    mkdir -p .cursor/rules
+    cat > .cursor/rules/cyberaudit.mdc << 'EOF'
+    ---
+    description: CyberAudit Security Skill
+    alwaysApply: false
+    ---
+
+    When you receive a command starting with /audit,
+    load and apply the CyberAudit skill from:
+    .skills/cyberaudit/
+
+    Always start by reading:
+    1. .skills/cyberaudit/COMMANDS.md
+    2. .skills/cyberaudit/AGENT-BOOT.md
+    3. The files defined in COMMANDS.md
+       according to the command received
+
+    You are CyberAudit, a cybersecurity expert.
+    Apply the behavior defined in AGENT-BOOT.md.
+    EOF
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+WINDSURF
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  Windsurf reads files in .windsurf/rules/
+
+  mkdir -p .windsurf/rules
+  cat > .windsurf/rules/cyberaudit.md << 'EOF'
+  # CyberAudit Security Skill
+
+  When you receive a /audit:xxx command,
+  consult .skills/cyberaudit/COMMANDS.md
+  to know which files to load and which
+  behavior to adopt.
+
+  Identity: .skills/cyberaudit/AGENT-BOOT.md
+  Principles: .skills/cyberaudit/MASTER.md
+  EOF
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+CLAUDE (claude.ai or API)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  OPTION 1 — CLAUDE.md at project root
+    Claude reads CLAUDE.md automatically
+
+    cat > CLAUDE.md << 'EOF'
+    # Security Skill
+
+    This project uses the CyberAudit skill.
+    When a /audit command is received,
+    load files from .skills/cyberaudit/
+    first consulting COMMANDS.md.
+    EOF
+
+  OPTION 2 — Via API (system prompt)
+    Inject the content of AGENT-BOOT.md + COMMANDS.md
+    into the system prompt of each audit session.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+GITHUB COPILOT
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  Copilot reads .github/copilot-instructions.md
+
+  mkdir -p .github
+  cat > .github/copilot-instructions.md << 'EOF'
+  # CyberAudit Security Instructions
+
+  This project integrates the CyberAudit skill for security
+  auditing. When a /audit command is detected,
+  apply the rules defined in:
+  .skills/cyberaudit/COMMANDS.md
+
+  For each generated code, passively apply
+  the security rules defined in:
+  .skills/cyberaudit/MASTER.md
+  EOF
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ANY OTHER AGENT (via API)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  Read the files and inject them as system prompt:
+
+  # Universal bash script
+  BOOT=$(cat .skills/cyberaudit/AGENT-BOOT.md)
+  MASTER=$(cat .skills/cyberaudit/MASTER.md)
+  COMMANDS=$(cat .skills/cyberaudit/COMMANDS.md)
+
+  SYSTEM_PROMPT="$BOOT\n\n$MASTER\n\n$COMMANDS"
+
+  # Pass SYSTEM_PROMPT to your agent via API
+
+═══════════════════════════════════════════════════════════════
+              USAGE
+═══════════════════════════════════════════════════════════════
+
+  Once installed and configured, usage
+  is immediate in your agent's chat:
+
+  COMMAND EXAMPLES:
+
+  Full automatic audit:
+    /audit src/
+
+  Quick scan before commit:
+    /audit:quick src/controllers/UserController.php
+
+  Specific framework audit:
+    /audit:laravel app/
+
+  Specific module:
+    /audit:auth src/middleware/
+    /audit:secrets .
+    /audit:deps
+
+  Mobile audit:
+    /audit:react-native src/
+    /audit:storage src/utils/storage.ts
+
+  Generate report after audit:
+    /audit:report
+    /audit:exec
+
+  Compliance:
+    /audit:rgpd src/
+    /audit:masvs src/
+
+  See all commands:
+    /audit:help
+
+═══════════════════════════════════════════════════════════════
+              CI/CD INTEGRATION
+═══════════════════════════════════════════════════════════════
+
+  GITHUB ACTIONS — Pre-merge security check
+
+  # .github/workflows/security-audit.yml
+
+  name: CyberAudit Security Check
+  on:
+    pull_request:
+      branches: [main, staging]
+
+  jobs:
+    security-audit:
+      runs-on: ubuntu-latest
+      steps:
+        - uses: actions/checkout@v4
+
+        - name: Load CyberAudit Skill
+          run: |
+            SKILL_CONTEXT=$(cat .skills/cyberaudit/AGENT-BOOT.md
+                           .skills/cyberaudit/MASTER.md
+                           .skills/cyberaudit/COMMANDS.md)
+            echo "SKILL_CONTEXT<<EOF" >> $GITHUB_ENV
+            echo "$SKILL_CONTEXT" >> $GITHUB_ENV
+            echo "EOF" >> $GITHUB_ENV
+
+        - name: Run Quick Audit
+          # Call your AI agent via API with the skill loaded
+          # and the /audit:quick command on changed files
+          run: |
+            echo "Quick security scan on changed files..."
+            # Your API call script here
+
+═══════════════════════════════════════════════════════════════
+              UPDATES
+═══════════════════════════════════════════════════════════════
+
+  # Check installed version
+  cat .skills/cyberaudit/INSTALL.md | grep "Version"
+
+  # Update
+  cd .skills/cyberaudit && git pull origin main
+
+  # Revert to a stable version
+  cd .skills/cyberaudit && git checkout v1.0.0
+
+  # List available versions
+  cd .skills/cyberaudit && git tag -l
+
+═══════════════════════════════════════════════════════════════
+              FILE STRUCTURE
+═══════════════════════════════════════════════════════════════
+
+  .skills/cyberaudit/
+  ├── COMMANDS.md              ← Command router (this file)
+  ├── INSTALL.md               ← This file
+  ├── AGENT-BOOT.md            ← Identity and boot sequence
+  ├── MASTER.md                ← Universal principles
+  ├── web/                     ← All web audit
+  │   ├── WEB-PHILOSOPHY.md
+  │   ├── WEB-CHECKLIST.md
+  │   ├── WEB-THREAT-MODELS.md
+  │   ├── frameworks/          ← Laravel, Next.js, NestJS...
+  │   ├── vulnerabilities/     ← SQLi, XSS, CSRF, IDOR...
+  │   └── WEB-REMEDIATION-LIBRARY.md
+  ├── mobile/                  ← All mobile audit
+  │   ├── MOBILE-PHILOSOPHY.md
+  │   ├── MOBILE-CHECKLIST.md
+  │   ├── MOBILE-THREAT-MODELS.md
+  │   ├── frameworks/          ← React Native, Flutter...
+  │   ├── vulnerabilities/     ← Storage, Network, IPC...
+  │   └── MOBILE-REMEDIATION-LIBRARY.md
+  ├── shared/                  ← Shared resources
+  │   ├── SEVERITY-SCORING.md
+  │   ├── CVSS-GUIDE.md
+  │   ├── OWASP-MAPPER.md
+  │   ├── THREAT-MODELING.md
+  │   └── COMPLIANCE.md
+  └── reports/                 ← Report templates
+      ├── REPORT-TEMPLATE-WEB.md
+      ├── REPORT-TEMPLATE-MOBILE.md
+      └── EXECUTIVE-SUMMARY-TEMPLATE.md
+
+═══════════════════════════════════════════════════════════════
+              SUPPORT AND CONTRIBUTION
+═══════════════════════════════════════════════════════════════
+
+  Report an issue:
+    github.com/yourname/cyberaudit-skill/issues
+
+  Suggest an improvement:
+    github.com/yourname/cyberaudit-skill/pulls
+
+  Add a new framework:
+    Create web/frameworks/NEW-FRAMEWORK.md
+    Follow LARAVEL.md structure as a template
+    Add the command in COMMANDS.md
+    Submit a PR
+
+  VERSION: 3.0.0 — LUNAIRE EDITION
+  LICENSE: MIT
+  STANDARDS: OWASP Top 10 2023 · MASVS 2.0 · CVSS 3.1

package/skills/cyberaudit/MASTER.md

@@ -0,0 +1,194 @@
+# CYBERAUDIT MASTER INTELLIGENCE
+# The brain file — Loaded permanently
+
+═══════════════════════════════════════════════════════════════
+              AUDIT MENTAL ARCHITECTURE
+═══════════════════════════════════════════════════════════════
+
+UNIVERSAL PRINCIPLE N°1 — THE ATTACK SURFACE IS EVERYWHERE
+──────────────────────────────────────────────────────────
+  Everything that receives data = attack surface
+  Everything that sends data = leak surface
+  Everything that makes decisions = bypass surface
+  Everything that stores data = exposure surface
+
+UNIVERSAL PRINCIPLE N°2 — SECURITY IS AN EMERGENT PROPERTY
+──────────────────────────────────────────────────────────
+  Security is not a feature you add.
+  It is a property that emerges from every architectural
+  decision, every line of code, every config.
+
+  A secure app = 10,000 correct micro-decisions.
+  A compromised app = 1 incorrect micro-decision.
+
+UNIVERSAL PRINCIPLE N°3 — THE ATTACKER HAS TIME
+─────────────────────────────────────────────────
+  The developer has deadlines.
+  The attacker has eternity.
+
+  What will "probably never happen"
+  will happen as soon as the app has value.
+
+UNIVERSAL PRINCIPLE N°4 — THE CHAIN OF TRUST
+───────────────────────────────────────────────
+  Always trace the full chain:
+
+  INPUT → VALIDATION → PROCESSING → STORAGE → OUTPUT
+    ↑                                            ↑
+  Where are the flaws?               Where does data leak?
+
+UNIVERSAL PRINCIPLE N°5 — THE CIA MODEL
+────────────────────────────────────────
+  Every finding must impact at least one pillar:
+
+  C — Confidentiality  (who can read what?)
+  I — Integrity        (who can modify what?)
+  A — Availability     (who can disrupt service?)
+
+  + Authentication    (is it really you?)
+  + Authorization     (do you have permission?)
+  + Non-repudiation   (can we prove who did what?)
+
+═══════════════════════════════════════════════════════════════
+              VULNERABILITY TAXONOMY
+═══════════════════════════════════════════════════════════════
+
+CATEGORY A — INJECTION (Hostile input → Execution)
+  A1. SQL Injection          → Database compromised
+  A2. NoSQL Injection        → MongoDB, Redis manipulated
+  A3. Command Injection      → OS compromised
+  A4. LDAP Injection         → Directory compromised
+  A5. XPath Injection        → XML data compromise
+  A6. SSTI                   → Template engine hijacked
+  A7. GraphQL Injection      → Graph API manipulated
+  A8. ORM Injection          → Bypassed abstraction
+  A9. Log Injection          → SIEM corrupted
+
+CATEGORY B — AUTHENTICATION (Identity compromised)
+  B1. Brute Force            → Account compromised by force
+  B2. Credential Stuffing    → Password reuse
+  B3. Session Fixation       → Session hijacking
+  B4. JWT Attacks            → Forged or stolen token
+  B5. OAuth Flaws            → Authorization code stolen
+  B6. Password Reset Flaws   → Account takeover
+  B7. MFA Bypass             → 2FA bypassed
+  B8. Default Credentials    → Admin/admin in production
+  B9. Auth Bypass            → Logic flaw in auth
+
+CATEGORY C — AUTHORIZATION (Rights not enforced)
+  C1. IDOR/BOLA              → Access to others' data
+  C2. BFLA                   → Admin functions without rights
+  C3. Privilege Escalation   → User → Admin
+  C4. Path Traversal         → Files outside scope
+  C5. RBAC Bypass            → Roles bypassed
+  C6. Mass Assignment        → Unauthorized fields modified
+  C7. JWT Role Manipulation  → Elevation via modified token
+
+CATEGORY D — DATA EXPOSURE (Leak)
+  D1. Hardcoded Secrets      → API keys in code
+  D2. Sensitive Data in Logs → PII in logs
+  D3. Error Messages         → Stack traces in production
+  D4. API Over-fetching      → Too much data returned
+  D5. Backup Files Exposed   → .sql, .bak accessible
+  D6. Source Maps in Prod    → Source code reconstructed
+  D7. Debug Endpoints        → /debug, /phpinfo in production
+  D8. Git History            → Secrets in history
+  D9. Directory Listing      → Structure exposed
+
+CATEGORY E — CONFIGURATION (Bad setup)
+  E1. CORS Misconfiguration  → Cross-origin abuse
+  E2. Missing Security Headers → CSP, HSTS, X-Frame missing
+  E3. TLS/SSL Issues         → Weak encryption
+  E4. CSRF Missing           → Forged actions
+  E5. Clickjacking           → UI hijacking
+  E6. Debug Mode in Prod     → Massive exposure
+  E7. Default Config         → Factory config in production
+  E8. Open Redirect          → Phishing enabled
+  E9. SSRF                   → Internal infrastructure exposed
+
+CATEGORY F — DEPENDENCIES (Supply Chain)
+  F1. CVE in dependencies    → Known vulnerabilities
+  F2. Outdated Packages      → Missed security patches
+  F3. Typosquatting          → Malicious package installed
+  F4. Dependency Confusion   → Internal package spoofed
+  F5. Malicious Package      → Backdoor in dependency
+  F6. License Issues         → Legal/compliance risk
+
+CATEGORY G — BUSINESS LOGIC (Logic Flaws)
+  G1. Race Conditions        → Double spend, double action
+  G2. Price Manipulation     → Bypassing prices
+  G3. Workflow Bypass        → Skipped steps
+  G4. Rate Limiting Missing  → Feature abuse
+  G5. Business Logic Abuse   → Unintended use
+  G6. Time-of-check/Time-of-use → TOCTOU attacks
+  G7. Negative Values        → Unexpected input
+
+═══════════════════════════════════════════════════════════════
+              SCORING AND PRIORITIZATION
+═══════════════════════════════════════════════════════════════
+
+SEVERITY MATRIX
+────────────────────
+
+  CRITICAL (Score 9.0-10.0)
+  ┌────────────────────────────────────────────────────────┐
+  │ Immediate exploitation with no prerequisites           │
+  │ Full impact on confidentiality/integrity/availability  │
+  │ No user interaction required                           │
+  │ Data of all users compromised                          │
+  │                                                        │
+  │ EXAMPLE: Unauthenticated SQLi on public endpoint       │
+  │ ACTION   : Block deployment. Fix NOW                   │
+  └────────────────────────────────────────────────────────┘
+
+  HIGH (Score 7.0-8.9)
+  ┌────────────────────────────────────────────────────────┐
+  │ Exploitation possible with few prerequisites           │
+  │ Significant impact on C, I, or A                       │
+  │ Data of one user or group compromised                  │
+  │                                                        │
+  │ EXAMPLE: IDOR on user profile                          │
+  │ ACTION   : Fix before next deployment                  │
+  └────────────────────────────────────────────────────────┘
+
+  MEDIUM (Score 4.0-6.9)
+  ┌────────────────────────────────────────────────────────┐
+  │ Exploitation requires specific conditions              │
+  │ Partial or limited impact                              │
+  │ Combinable with other flaws for amplification          │
+  │                                                        │
+  │ EXAMPLE: CSRF on non-critical action                   │
+  │ ACTION   : Schedule in next sprint                     │
+  └────────────────────────────────────────────────────────┘
+
+  LOW (Score 0.1-3.9)
+  ┌────────────────────────────────────────────────────────┐
+  │ Minimal impact, complex exploitation                   │
+  │ General security posture improvement                   │
+  │                                                        │
+  │ EXAMPLE: Missing X-Content-Type-Options header          │
+  │ ACTION   : Security backlog, fix in batch              │
+  └────────────────────────────────────────────────────────┘
+
+  INFO (Score 0.0)
+  ┌────────────────────────────────────────────────────────┐
+  │ No direct risk but important observation               │
+  │ Best practice not followed                             │
+  │ Attention point for future architecture                │
+  │                                                        │
+  │ EXAMPLE: Missing audit logging                         │
+  │ ACTION   : Documented recommendation                   │
+  └────────────────────────────────────────────────────────┘
+
+AGGRAVATING FACTORS (increase severity)
+  + Application exposed on public Internet          → +1 level
+  + PII/financial/health data involved              → +1 level
+  + No defense layer upstream                       → +0.5 level
+  + Exploitation already publicly documented (PoC)  → +1 level
+  + Flaw in auth/payment component                  → +1 level
+
+MITIGATING FACTORS (decrease severity)
+  - Authenticated access required to exploit        → -1 level
+  - WAF or other protection layer active            → -0.5 level
+  - Internal network access only                    → -1 level
+  - Impact limited to non-sensitive data            → -0.5 level

package/skills/cyberaudit/README.md

@@ -0,0 +1,154 @@
+# 🛡️ CyberAudit Skill — LUNAIRE EDITION
+
+**Version 3.0.0** · Pure Markdown · Universal Security Intelligence · Zero dependency
+
+[![OWASP](https://img.shields.io/badge/OWASP_Top_10-2021-blue)](#)
+[![MASVS](https://img.shields.io/badge/OWASP_MASVS-2.0-green)](#)
+[![CVSS](https://img.shields.io/badge/CVSS-3.1-orange)](#)
+[![Frameworks](https://img.shields.io/badge/Frameworks-11-purple)](#)
+[![Files](https://img.shields.io/badge/Files-52-lightgrey)](#)
+
+---
+
+## 📋 Description
+
+CyberAudit Skill turns any AI agent (Cursor, Claude, GPT, Copilot) into an OSCP/OSCE-level **security expert**.
+
+52 Markdown files encoding 15 years of real pentesting, security architecture, and vulnerability research. The agent doesn't scan — it **thinks**, **contextualizes**, and **prioritizes** like a human.
+
+> *"I don't look for vulnerabilities to destroy. I look for vulnerabilities to protect."*
+
+---
+
+## ✨ Features
+
+| Domain | Coverage |
+|---|---|
+| **Web** | 7 frameworks, 13 vulnerability types, threat modeling, remediation |
+| **Mobile** | 4 frameworks, 8 vulnerability types, MASVS 2.0 aligned |
+| **Scoring** | Full CVSS 3.1 with aggravating/mitigating context factors |
+| **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2 — built-in checklists |
+| **Reports** | Web + Mobile + Executive Summary templates |
+| **Levels** | Quick Scan → Standard → Deep → Red Team |
+
+---
+
+## 🏗️ Architecture
+
+```
+cyberaudit-skill/
+├── AGENT-BOOT.md · MASTER.md · USAGE-GUIDE.md
+├── INSTALL.md · COMMANDS.md
+│
+├── web/
+│   ├── WEB-PHILOSOPHY.md · WEB-CHECKLIST.md
+│   ├── WEB-THREAT-MODELS.md · WEB-REMEDIATION-LIBRARY.md
+│   ├── frameworks/  (React, Next.js, Laravel, NestJS, Express, Vue, Angular)
+│   └── vulnerabilities/  (Injection, XSS, CSRF, IDOR, SSRF, XXE…)
+│
+├── mobile/
+│   ├── MOBILE-PHILOSOPHY.md · MOBILE-CHECKLIST.md
+│   ├── MOBILE-THREAT-MODELS.md · MOBILE-REMEDIATION-LIBRARY.md
+│   ├── frameworks/  (React Native, Flutter, Ionic, Expo)
+│   └── vulnerabilities/  (Storage, Network, Binary, Permissions, IPC…)
+│
+├── shared/
+│   ├── SEVERITY-SCORING.md · CVSS-GUIDE.md
+│   ├── OWASP-MAPPER.md · THREAT-MODELING.md
+│   └── COMPLIANCE.md
+│
+└── reports/
+    ├── REPORT-TEMPLATE-WEB.md
+    ├── REPORT-TEMPLATE-MOBILE.md
+    └── EXECUTIVE-SUMMARY-TEMPLATE.md
+```
+
+**52 files, 100% Markdown, zero dependency.**
+
+---
+
+## 🚀 Quick Start
+
+```bash
+# 1. Clone the skill into your project
+git clone https://github.com/your-account/cyberaudit-skill .skills/cyberaudit
+
+# 2. Point your AI agent to the boot
+# Simply say:
+"Load .skills/cyberaudit/AGENT-BOOT.md and audit this project"
+```
+
+**Detailed installation → [INSTALL.md](./INSTALL.md)**
+
+---
+
+## 🎯 Audit Levels
+
+| Level | Duration | Scope | Output |
+|---|---|---|---|
+| **1 — Quick Scan** | 15-30 min | Secrets, critical CVEs, auth bypass | Critical + high list |
+| **2 — Standard** | 1-2h | All level 1 + full auth, user inputs, config | All-levels report |
+| **3 — Deep Audit** | 3-5h | All level 2 + threat modeling, business logic, architecture | Pro report + remediation plan |
+| **4 — Red Team** | On demand | All level 3 + kill chains, financial impact | Complete Red Team report |
+
+---
+
+## 📚 Couverture
+
+### Frameworks Web
+React · Next.js · Laravel · NestJS · Express · Vue.js · Angular
+
+### Frameworks Mobile
+React Native · Flutter · Ionic/Capacitor · Expo
+
+### Web Vulnerabilities (13)
+SQL/NoSQL Injection · XSS · CSRF · CORS · IDOR/BOLA · SSRF · XXE · Deserialization · Supply Chain · Exposed Secrets · Missing Headers · Auth & AuthZ · Business Logic
+
+### Mobile Vulnerabilities (8)
+Local Storage · Network · Binary Analysis · Permissions · IPC & Deep Links · Mobile Auth · Mobile Crypto · Runtime
+
+### Compliance
+RGPD (Privacy by Design, user rights) · PCI-DSS (payment cards) · HIPAA (health data) · SOC 2
+
+---
+
+## 💡 Using with AI Agents
+
+```text
+Full web audit:
+  "Audit this React app using the CyberAudit Skill."
+
+Quick scan:
+  "Run a security quick scan. Focus on critical and high only."
+
+Mobile audit:
+  "Audit this Flutter app. Check storage and network."
+
+PR review:
+  "Review this PR from a security perspective."
+
+Threat modeling:
+  "Run a STRIDE threat model on this new feature."
+```
+
+**All commands → [COMMANDS.md](./COMMANDS.md)**
+
+---
+
+## 🛠️ Prerequisites
+
+- Git
+- A compatible AI agent (Cursor, Claude, GPT, Copilot, Windsurf…)
+- **Zero dependency. Zero runtime. Zero compilation.**
+
+---
+
+## 📄 License
+
+CyberAudit Skill — LUNAIRE EDITION  
+Free to use. Attribution appreciated.
+
+---
+
+*Generated by CyberAudit Skill v3.0 — LUNAIRE EDITION*  
+*Aligned with OWASP Top 10 2023 · OWASP MASVS 2.0 · CVSS 3.1*