cyberaudit-skill 3.0.4 β†’ 3.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/skills/cyberaudit/README.md +27 -137
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cyberaudit-skill",
3
- "version": "3.0.4",
3
+ "version": "3.0.5",
4
4
  "description": "Universal security audit skill for AI agents. Install once, audit any web or mobile app. OpenCode, Claude Code, Cursor, Kiro, Gemini β€” all supported.",
5
5
  "keywords": [
6
6
  "mcp",
package/skills/cyberaudit/README.md CHANGED
@@ -1,154 +1,44 @@
1
- # πŸ›‘οΈ CyberAudit Skill β€” LUNAIRE EDITION
1
+ # CyberAudit Skill
2
2
 
3
- **Version 3.0.0** Β· Pure Markdown Β· Universal Security Intelligence Β· Zero dependency
3
+ Security audit intelligence for AI agents. Pure Markdown, zero dependencies.
4
4
 
5
- [![OWASP](https://img.shields.io/badge/OWASP_Top_10-2021-blue)](#)
6
- [![MASVS](https://img.shields.io/badge/OWASP_MASVS-2.0-green)](#)
7
- [![CVSS](https://img.shields.io/badge/CVSS-3.1-orange)](#)
8
- [![Frameworks](https://img.shields.io/badge/Frameworks-11-purple)](#)
9
- [![Files](https://img.shields.io/badge/Files-52-lightgrey)](#)
5
+ ## Coverage
10
6
 
11
- ---
12
-
13
- ## πŸ“‹ Description
14
-
15
- CyberAudit Skill turns any AI agent (Cursor, Claude, GPT, Copilot) into an OSCP/OSCE-level **security expert**.
16
-
17
- 52 Markdown files encoding 15 years of real pentesting, security architecture, and vulnerability research. The agent doesn't scan β€” it **thinks**, **contextualizes**, and **prioritizes** like a human.
18
-
19
- > *"I don't look for vulnerabilities to destroy. I look for vulnerabilities to protect."*
20
-
21
- ---
22
-
23
- ## ✨ Features
24
-
25
- | Domain | Coverage |
7
+ | Domain | Detail |
26
8
  |---|---|
27
- | **Web** | 7 frameworks, 13 vulnerability types, threat modeling, remediation |
28
- | **Mobile** | 4 frameworks, 8 vulnerability types, MASVS 2.0 aligned |
29
- | **Scoring** | Full CVSS 3.1 with aggravating/mitigating context factors |
30
- | **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2 β€” built-in checklists |
9
+ | **Web** | 7 frameworks (React, Next.js, Laravel, NestJS, Express, Vue, Angular), 13 vulnerability types |
10
+ | **Mobile** | 4 frameworks (React Native, Flutter, Ionic, Expo), 8 vulnerability types |
11
+ | **Scoring** | CVSS 3.1 with aggravating/mitigating context factors |
12
+ | **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2 |
31
13
  | **Reports** | Web + Mobile + Executive Summary templates |
32
- | **Levels** | Quick Scan β†’ Standard β†’ Deep β†’ Red Team |
33
14
 
34
- ---
35
-
36
- ## πŸ—οΈ Architecture
15
+ ## Files
37
16
 
38
17
  ```
39
- cyberaudit-skill/
40
- β”œβ”€β”€ AGENT-BOOT.md Β· MASTER.md Β· USAGE-GUIDE.md
41
- β”œβ”€β”€ INSTALL.md Β· COMMANDS.md
42
- β”‚
43
- β”œβ”€β”€ web/
44
- β”‚ β”œβ”€β”€ WEB-PHILOSOPHY.md Β· WEB-CHECKLIST.md
45
- β”‚ β”œβ”€β”€ WEB-THREAT-MODELS.md Β· WEB-REMEDIATION-LIBRARY.md
46
- β”‚ β”œβ”€β”€ frameworks/ (React, Next.js, Laravel, NestJS, Express, Vue, Angular)
47
- β”‚ └── vulnerabilities/ (Injection, XSS, CSRF, IDOR, SSRF, XXE…)
48
- β”‚
49
- β”œβ”€β”€ mobile/
50
- β”‚ β”œβ”€β”€ MOBILE-PHILOSOPHY.md Β· MOBILE-CHECKLIST.md
51
- β”‚ β”œβ”€β”€ MOBILE-THREAT-MODELS.md Β· MOBILE-REMEDIATION-LIBRARY.md
52
- β”‚ β”œβ”€β”€ frameworks/ (React Native, Flutter, Ionic, Expo)
53
- β”‚ └── vulnerabilities/ (Storage, Network, Binary, Permissions, IPC…)
54
- β”‚
55
- β”œβ”€β”€ shared/
56
- β”‚ β”œβ”€β”€ SEVERITY-SCORING.md Β· CVSS-GUIDE.md
57
- β”‚ β”œβ”€β”€ OWASP-MAPPER.md Β· THREAT-MODELING.md
58
- β”‚ └── COMPLIANCE.md
59
- β”‚
60
- └── reports/
61
- β”œβ”€β”€ REPORT-TEMPLATE-WEB.md
62
- β”œβ”€β”€ REPORT-TEMPLATE-MOBILE.md
63
- └── EXECUTIVE-SUMMARY-TEMPLATE.md
18
+ AGENT-BOOT.md Boot sequence, oath, audit levels
19
+ SKILL.md Main intelligence, taxonomy, rules
20
+ COMMANDS.md Operational commands
21
+ USAGE-GUIDE.md User-facing guide
22
+ MASTER.md Full vulnerability taxonomy + scoring
23
+ web/ Web audit checklists, per-framework guides
24
+ mobile/ Mobile audit checklists, per-framework guides
25
+ shared/ Scoring, CVSS, OWASP mapping, compliance
26
+ reports/ Report templates (web, mobile, executive)
64
27
  ```
65
28
 
66
- **52 files, 100% Markdown, zero dependency.**
29
+ ## Audit Levels
67
30
 
68
- ---
31
+ - **Quick Scan** (15-30 min): Secrets, critical CVEs, auth bypass
32
+ - **Standard** (1-2h): Full auth, inputs, config, dependencies
33
+ - **Deep** (3-5h): Threat modeling, business logic, architecture
34
+ - **Red Team** (on request): Kill chains, full exploitation
69
35
 
70
- ## πŸš€ Quick Start
36
+ ## Install
71
37
 
72
38
  ```bash
73
- # 1. Clone the skill into your project
74
- git clone https://github.com/your-account/cyberaudit-skill .skills/cyberaudit
75
-
76
- # 2. Point your AI agent to the boot
77
- # Simply say:
78
- "Load .skills/cyberaudit/AGENT-BOOT.md and audit this project"
39
+ npx -y cyberaudit-skill install
79
40
  ```
80
41
 
81
- **Detailed installation β†’ [INSTALL.md](./INSTALL.md)**
82
-
83
- ---
84
-
85
- ## 🎯 Audit Levels
86
-
87
- | Level | Duration | Scope | Output |
88
- |---|---|---|---|
89
- | **1 β€” Quick Scan** | 15-30 min | Secrets, critical CVEs, auth bypass | Critical + high list |
90
- | **2 β€” Standard** | 1-2h | All level 1 + full auth, user inputs, config | All-levels report |
91
- | **3 β€” Deep Audit** | 3-5h | All level 2 + threat modeling, business logic, architecture | Pro report + remediation plan |
92
- | **4 β€” Red Team** | On demand | All level 3 + kill chains, financial impact | Complete Red Team report |
93
-
94
- ---
95
-
96
- ## πŸ“š Couverture
97
-
98
- ### Frameworks Web
99
- React Β· Next.js Β· Laravel Β· NestJS Β· Express Β· Vue.js Β· Angular
100
-
101
- ### Frameworks Mobile
102
- React Native Β· Flutter Β· Ionic/Capacitor Β· Expo
103
-
104
- ### Web Vulnerabilities (13)
105
- SQL/NoSQL Injection Β· XSS Β· CSRF Β· CORS Β· IDOR/BOLA Β· SSRF Β· XXE Β· Deserialization Β· Supply Chain Β· Exposed Secrets Β· Missing Headers Β· Auth & AuthZ Β· Business Logic
106
-
107
- ### Mobile Vulnerabilities (8)
108
- Local Storage Β· Network Β· Binary Analysis Β· Permissions Β· IPC & Deep Links Β· Mobile Auth Β· Mobile Crypto Β· Runtime
109
-
110
- ### Compliance
111
- RGPD (Privacy by Design, user rights) Β· PCI-DSS (payment cards) Β· HIPAA (health data) Β· SOC 2
112
-
113
- ---
114
-
115
- ## πŸ’‘ Using with AI Agents
116
-
117
- ```text
118
- Full web audit:
119
- "Audit this React app using the CyberAudit Skill."
120
-
121
- Quick scan:
122
- "Run a security quick scan. Focus on critical and high only."
123
-
124
- Mobile audit:
125
- "Audit this Flutter app. Check storage and network."
126
-
127
- PR review:
128
- "Review this PR from a security perspective."
129
-
130
- Threat modeling:
131
- "Run a STRIDE threat model on this new feature."
132
- ```
133
-
134
- **All commands β†’ [COMMANDS.md](./COMMANDS.md)**
135
-
136
- ---
137
-
138
- ## πŸ› οΈ Prerequisites
139
-
140
- - Git
141
- - A compatible AI agent (Cursor, Claude, GPT, Copilot, Windsurf…)
142
- - **Zero dependency. Zero runtime. Zero compilation.**
143
-
144
- ---
145
-
146
- ## πŸ“„ License
147
-
148
- CyberAudit Skill β€” LUNAIRE EDITION
149
- Free to use. Attribution appreciated.
150
-
151
- ---
42
+ ## License
152
43
 
153
- *Generated by CyberAudit Skill v3.0 β€” LUNAIRE EDITION*
154
- *Aligned with OWASP Top 10 2023 Β· OWASP MASVS 2.0 Β· CVSS 3.1*
44
+ MIT