cyberaudit-skill 3.0.4 β 3.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +9 -2
- package/package.json +1 -1
- package/skills/cyberaudit/COMMANDS.md +71 -1125
- package/skills/cyberaudit/README.md +27 -137
- package/skills/cyberaudit/SKILL.md +64 -2
|
@@ -1,154 +1,44 @@
|
|
|
1
|
-
#
|
|
1
|
+
# CyberAudit Skill
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Security audit intelligence for AI agents. Pure Markdown, zero dependencies.
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
[](#)
|
|
7
|
-
[](#)
|
|
8
|
-
[](#)
|
|
9
|
-
[](#)
|
|
5
|
+
## Coverage
|
|
10
6
|
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
## π Description
|
|
14
|
-
|
|
15
|
-
CyberAudit Skill turns any AI agent (Cursor, Claude, GPT, Copilot) into an OSCP/OSCE-level **security expert**.
|
|
16
|
-
|
|
17
|
-
52 Markdown files encoding 15 years of real pentesting, security architecture, and vulnerability research. The agent doesn't scan β it **thinks**, **contextualizes**, and **prioritizes** like a human.
|
|
18
|
-
|
|
19
|
-
> *"I don't look for vulnerabilities to destroy. I look for vulnerabilities to protect."*
|
|
20
|
-
|
|
21
|
-
---
|
|
22
|
-
|
|
23
|
-
## β¨ Features
|
|
24
|
-
|
|
25
|
-
| Domain | Coverage |
|
|
7
|
+
| Domain | Detail |
|
|
26
8
|
|---|---|
|
|
27
|
-
| **Web** | 7 frameworks,
|
|
28
|
-
| **Mobile** | 4 frameworks,
|
|
29
|
-
| **Scoring** |
|
|
30
|
-
| **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2
|
|
9
|
+
| **Web** | 7 frameworks (React, Next.js, Laravel, NestJS, Express, Vue, Angular), 13 vulnerability types |
|
|
10
|
+
| **Mobile** | 4 frameworks (React Native, Flutter, Ionic, Expo), 8 vulnerability types |
|
|
11
|
+
| **Scoring** | CVSS 3.1 with aggravating/mitigating context factors |
|
|
12
|
+
| **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2 |
|
|
31
13
|
| **Reports** | Web + Mobile + Executive Summary templates |
|
|
32
|
-
| **Levels** | Quick Scan β Standard β Deep β Red Team |
|
|
33
14
|
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
## ποΈ Architecture
|
|
15
|
+
## Files
|
|
37
16
|
|
|
38
17
|
```
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
β
|
|
49
|
-
βββ mobile/
|
|
50
|
-
β βββ MOBILE-PHILOSOPHY.md Β· MOBILE-CHECKLIST.md
|
|
51
|
-
β βββ MOBILE-THREAT-MODELS.md Β· MOBILE-REMEDIATION-LIBRARY.md
|
|
52
|
-
β βββ frameworks/ (React Native, Flutter, Ionic, Expo)
|
|
53
|
-
β βββ vulnerabilities/ (Storage, Network, Binary, Permissions, IPCβ¦)
|
|
54
|
-
β
|
|
55
|
-
βββ shared/
|
|
56
|
-
β βββ SEVERITY-SCORING.md Β· CVSS-GUIDE.md
|
|
57
|
-
β βββ OWASP-MAPPER.md Β· THREAT-MODELING.md
|
|
58
|
-
β βββ COMPLIANCE.md
|
|
59
|
-
β
|
|
60
|
-
βββ reports/
|
|
61
|
-
βββ REPORT-TEMPLATE-WEB.md
|
|
62
|
-
βββ REPORT-TEMPLATE-MOBILE.md
|
|
63
|
-
βββ EXECUTIVE-SUMMARY-TEMPLATE.md
|
|
18
|
+
AGENT-BOOT.md Boot sequence, oath, audit levels
|
|
19
|
+
SKILL.md Main intelligence, taxonomy, rules
|
|
20
|
+
COMMANDS.md Operational commands
|
|
21
|
+
USAGE-GUIDE.md User-facing guide
|
|
22
|
+
MASTER.md Full vulnerability taxonomy + scoring
|
|
23
|
+
web/ Web audit checklists, per-framework guides
|
|
24
|
+
mobile/ Mobile audit checklists, per-framework guides
|
|
25
|
+
shared/ Scoring, CVSS, OWASP mapping, compliance
|
|
26
|
+
reports/ Report templates (web, mobile, executive)
|
|
64
27
|
```
|
|
65
28
|
|
|
66
|
-
|
|
29
|
+
## Audit Levels
|
|
67
30
|
|
|
68
|
-
|
|
31
|
+
- **Quick Scan** (15-30 min): Secrets, critical CVEs, auth bypass
|
|
32
|
+
- **Standard** (1-2h): Full auth, inputs, config, dependencies
|
|
33
|
+
- **Deep** (3-5h): Threat modeling, business logic, architecture
|
|
34
|
+
- **Red Team** (on request): Kill chains, full exploitation
|
|
69
35
|
|
|
70
|
-
##
|
|
36
|
+
## Install
|
|
71
37
|
|
|
72
38
|
```bash
|
|
73
|
-
|
|
74
|
-
git clone https://github.com/your-account/cyberaudit-skill .skills/cyberaudit
|
|
75
|
-
|
|
76
|
-
# 2. Point your AI agent to the boot
|
|
77
|
-
# Simply say:
|
|
78
|
-
"Load .skills/cyberaudit/AGENT-BOOT.md and audit this project"
|
|
39
|
+
npx -y cyberaudit-skill install
|
|
79
40
|
```
|
|
80
41
|
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
---
|
|
84
|
-
|
|
85
|
-
## π― Audit Levels
|
|
86
|
-
|
|
87
|
-
| Level | Duration | Scope | Output |
|
|
88
|
-
|---|---|---|---|
|
|
89
|
-
| **1 β Quick Scan** | 15-30 min | Secrets, critical CVEs, auth bypass | Critical + high list |
|
|
90
|
-
| **2 β Standard** | 1-2h | All level 1 + full auth, user inputs, config | All-levels report |
|
|
91
|
-
| **3 β Deep Audit** | 3-5h | All level 2 + threat modeling, business logic, architecture | Pro report + remediation plan |
|
|
92
|
-
| **4 β Red Team** | On demand | All level 3 + kill chains, financial impact | Complete Red Team report |
|
|
93
|
-
|
|
94
|
-
---
|
|
95
|
-
|
|
96
|
-
## π Couverture
|
|
97
|
-
|
|
98
|
-
### Frameworks Web
|
|
99
|
-
React Β· Next.js Β· Laravel Β· NestJS Β· Express Β· Vue.js Β· Angular
|
|
100
|
-
|
|
101
|
-
### Frameworks Mobile
|
|
102
|
-
React Native Β· Flutter Β· Ionic/Capacitor Β· Expo
|
|
103
|
-
|
|
104
|
-
### Web Vulnerabilities (13)
|
|
105
|
-
SQL/NoSQL Injection Β· XSS Β· CSRF Β· CORS Β· IDOR/BOLA Β· SSRF Β· XXE Β· Deserialization Β· Supply Chain Β· Exposed Secrets Β· Missing Headers Β· Auth & AuthZ Β· Business Logic
|
|
106
|
-
|
|
107
|
-
### Mobile Vulnerabilities (8)
|
|
108
|
-
Local Storage Β· Network Β· Binary Analysis Β· Permissions Β· IPC & Deep Links Β· Mobile Auth Β· Mobile Crypto Β· Runtime
|
|
109
|
-
|
|
110
|
-
### Compliance
|
|
111
|
-
RGPD (Privacy by Design, user rights) Β· PCI-DSS (payment cards) Β· HIPAA (health data) Β· SOC 2
|
|
112
|
-
|
|
113
|
-
---
|
|
114
|
-
|
|
115
|
-
## π‘ Using with AI Agents
|
|
116
|
-
|
|
117
|
-
```text
|
|
118
|
-
Full web audit:
|
|
119
|
-
"Audit this React app using the CyberAudit Skill."
|
|
120
|
-
|
|
121
|
-
Quick scan:
|
|
122
|
-
"Run a security quick scan. Focus on critical and high only."
|
|
123
|
-
|
|
124
|
-
Mobile audit:
|
|
125
|
-
"Audit this Flutter app. Check storage and network."
|
|
126
|
-
|
|
127
|
-
PR review:
|
|
128
|
-
"Review this PR from a security perspective."
|
|
129
|
-
|
|
130
|
-
Threat modeling:
|
|
131
|
-
"Run a STRIDE threat model on this new feature."
|
|
132
|
-
```
|
|
133
|
-
|
|
134
|
-
**All commands β [COMMANDS.md](./COMMANDS.md)**
|
|
135
|
-
|
|
136
|
-
---
|
|
137
|
-
|
|
138
|
-
## π οΈ Prerequisites
|
|
139
|
-
|
|
140
|
-
- Git
|
|
141
|
-
- A compatible AI agent (Cursor, Claude, GPT, Copilot, Windsurfβ¦)
|
|
142
|
-
- **Zero dependency. Zero runtime. Zero compilation.**
|
|
143
|
-
|
|
144
|
-
---
|
|
145
|
-
|
|
146
|
-
## π License
|
|
147
|
-
|
|
148
|
-
CyberAudit Skill β LUNAIRE EDITION
|
|
149
|
-
Free to use. Attribution appreciated.
|
|
150
|
-
|
|
151
|
-
---
|
|
42
|
+
## License
|
|
152
43
|
|
|
153
|
-
|
|
154
|
-
*Aligned with OWASP Top 10 2023 Β· OWASP MASVS 2.0 Β· CVSS 3.1*
|
|
44
|
+
MIT
|
|
@@ -5,7 +5,7 @@ description: >
|
|
|
5
5
|
Use when auditing source code for vulnerabilities β full methodology from
|
|
6
6
|
quick scan to red team. Follows OWASP Top 10 2023, CVSS 3.1, ASVS 4.0.
|
|
7
7
|
Trigger: "audit", "security", "vulnerability", "pentest", "OWASP",
|
|
8
|
-
"scan my code", "security review".
|
|
8
|
+
"scan my code", "security review", "commands", "help".
|
|
9
9
|
compatibility: Pure Markdown skill, no external dependencies. Works with any AI agent that loads SKILL.md.
|
|
10
10
|
metadata:
|
|
11
11
|
author: ArisRoman
|
|
@@ -13,10 +13,72 @@ metadata:
|
|
|
13
13
|
allowed-tools: Read Edit Grep Glob Bash
|
|
14
14
|
---
|
|
15
15
|
|
|
16
|
-
# CyberAudit Skill
|
|
16
|
+
# CyberAudit Skill
|
|
17
17
|
|
|
18
18
|
Security audit intelligence for AI agents. Universal, framework-agnostic, methodology-driven.
|
|
19
19
|
|
|
20
|
+
## Available Commands
|
|
21
|
+
|
|
22
|
+
### Global
|
|
23
|
+
| Command | Action |
|
|
24
|
+
|---|---|
|
|
25
|
+
| `/audit` | Full audit (auto-detect web/mobile) |
|
|
26
|
+
| `/audit:quick` | Quick scan β criticals only |
|
|
27
|
+
| `/audit:report` | Generate full report |
|
|
28
|
+
| `/audit:exec` | Generate executive summary |
|
|
29
|
+
|
|
30
|
+
### Web
|
|
31
|
+
| Command | Action |
|
|
32
|
+
|---|---|
|
|
33
|
+
| `/audit:web` | Full web audit (OWASP Top 10) |
|
|
34
|
+
| `/audit:auth` | Authentication & Authorization |
|
|
35
|
+
| `/audit:injection` | SQL, NoSQL, Command, SSTI |
|
|
36
|
+
| `/audit:xss` | Cross-Site Scripting |
|
|
37
|
+
| `/audit:csrf` | Cross-Site Request Forgery |
|
|
38
|
+
| `/audit:cors` | CORS configuration |
|
|
39
|
+
| `/audit:headers` | HTTP security headers |
|
|
40
|
+
| `/audit:secrets` | Exposed secrets & credentials |
|
|
41
|
+
| `/audit:deps` | Dependencies & supply chain |
|
|
42
|
+
| `/audit:ssrf` | Server-Side Request Forgery |
|
|
43
|
+
| `/audit:idor` | IDOR & access control |
|
|
44
|
+
| `/audit:logic` | Business logic flaws |
|
|
45
|
+
| `/audit:crypto` | Web cryptography |
|
|
46
|
+
| `/audit:xxe` | XML External Entities |
|
|
47
|
+
| `/audit:deserial` | Insecure deserialization |
|
|
48
|
+
| `/audit:laravel` | Laravel-specific audit |
|
|
49
|
+
| `/audit:nextjs` | Next.js-specific audit |
|
|
50
|
+
| `/audit:react` | React-specific audit |
|
|
51
|
+
| `/audit:nestjs` | NestJS-specific audit |
|
|
52
|
+
| `/audit:express` | Express-specific audit |
|
|
53
|
+
| `/audit:vue` | Vue.js-specific audit |
|
|
54
|
+
| `/audit:angular` | Angular-specific audit |
|
|
55
|
+
|
|
56
|
+
### Mobile
|
|
57
|
+
| Command | Action |
|
|
58
|
+
|---|---|
|
|
59
|
+
| `/audit:mobile` | Full mobile audit (OWASP MASVS) |
|
|
60
|
+
| `/audit:storage` | Local storage security |
|
|
61
|
+
| `/audit:network` | Network security |
|
|
62
|
+
| `/audit:binary` | Binary analysis |
|
|
63
|
+
| `/audit:permissions` | Permissions audit |
|
|
64
|
+
| `/audit:deeplinks` | Deep links & IPC |
|
|
65
|
+
| `/audit:auth-mobile` | Mobile authentication |
|
|
66
|
+
| `/audit:crypto-mobile` | Mobile cryptography |
|
|
67
|
+
| `/audit:runtime` | Runtime security |
|
|
68
|
+
| `/audit:react-native` | React Native audit |
|
|
69
|
+
| `/audit:flutter` | Flutter audit |
|
|
70
|
+
| `/audit:ionic` | Ionic audit |
|
|
71
|
+
| `/audit:expo` | Expo audit |
|
|
72
|
+
|
|
73
|
+
### Compliance
|
|
74
|
+
| Command | Action |
|
|
75
|
+
|---|---|
|
|
76
|
+
| `/audit:rgpd` | RGPD compliance check |
|
|
77
|
+
| `/audit:pci` | PCI-DSS compliance check |
|
|
78
|
+
| `/audit:hipaa` | HIPAA compliance check |
|
|
79
|
+
| `/audit:masvs` | MASVS 2.0 score |
|
|
80
|
+
| `/audit:owasp` | OWASP Top 10 score |
|
|
81
|
+
|
|
20
82
|
## Boot Sequence
|
|
21
83
|
|
|
22
84
|
Execute on every audit request:
|