cyberaudit-skill 3.1.4 → 3.2.0

package/dist/scanners/web.js

@@ -0,0 +1,327 @@
+import { readFileSync, readdirSync, statSync, existsSync } from 'fs';
+import { join, extname } from 'path';
+const IGNORE_DIRS = ['node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', '.cache', 'vendor', 'out'];
+function shouldIgnoreDir(name) {
+    return IGNORE_DIRS.includes(name);
+}
+function walkFiles(dir, exts, maxSize = 1_000_000) {
+    const files = [];
+    const walk = (d) => {
+        try {
+            const entries = readdirSync(d);
+            for (const e of entries) {
+                if (shouldIgnoreDir(e))
+                    continue;
+                const full = join(d, e);
+                try {
+                    const st = statSync(full);
+                    if (st.isDirectory())
+                        walk(full);
+                    else if (st.isFile()) {
+                        if (st.size > maxSize)
+                            continue;
+                        const ext = extname(full).toLowerCase();
+                        // Allow .js, .ts, .jsx, .tsx, .vue, .php, .py etc
+                        if (exts.length === 0 || exts.includes(ext) || full.endsWith('.js') || full.endsWith('.ts')) {
+                            // Quick binary skip
+                            if (['.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.woff', '.woff2'].includes(ext))
+                                continue;
+                            files.push(full);
+                        }
+                    }
+                }
+                catch { }
+            }
+        }
+        catch { }
+    };
+    walk(dir);
+    return files;
+}
+const WEB_PATTERNS = [
+    {
+        id: 'WEB_SQLI_CONCAT',
+        name: 'SQL Injection via string concatenation / template literal',
+        regex: /(?:db|pool|connection|client)\.(?:query|execute)\s*\(\s*["'`].*\+.*req\.|(?:query|execute)\s*\(\s*`[^`]*\$\{[^}]*req\.[^}]*\}[^`]*`/gi,
+        severity: 'CRITICAL',
+        cvss: 9.8,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+        description: 'SQL query built via string concatenation or template literal with user input (req.*). Classic SQLi.',
+        remediation: 'Use parameterized queries: db.query("SELECT * FROM users WHERE id = ?", [id]) or ORM safe methods. Never interpolate user input.',
+        owasp: 'A03:2021 — Injection',
+        cwe: 'CWE-89',
+        extensions: ['.js', '.ts', '.jsx', '.tsx', '.php'],
+    },
+    {
+        id: 'WEB_SQLI_RAW',
+        name: 'SQL Injection via raw query with interpolation',
+        regex: /(?:SELECT|INSERT|UPDATE|DELETE).*\+.*req\.(?:body|query|params)\./gi,
+        severity: 'CRITICAL',
+        cvss: 9.8,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+        description: 'Raw SQL contains req.body/query/params concatenation.',
+        remediation: 'Use prepared statements / ORM. Validate whitelist for ORDER BY / table names.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-89',
+    },
+    {
+        id: 'WEB_XSS_DANGEROUS',
+        name: 'XSS via dangerouslySetInnerHTML without DOMPurify',
+        regex: /dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:\s*[^}]*\}/g,
+        severity: 'HIGH',
+        cvss: 7.5,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
+        description: 'React dangerouslySetInnerHTML used. If user input reaches it without sanitization, XSS.',
+        remediation: 'Use DOMPurify: import DOMPurify from "dompurify"; <div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} /> or avoid innerHTML.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-79',
+        falsePositiveIfContains: ['DOMPurify', 'sanitize'],
+    },
+    {
+        id: 'WEB_XSS_INNERHTML',
+        name: 'XSS via innerHTML assignment',
+        regex: /(?:\.innerHTML\s*=|v-html\s*=|{{\s*.*\s*\|\s*safe}})/g,
+        severity: 'HIGH',
+        cvss: 7.2,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N',
+        description: 'Direct innerHTML assignment or v-html without sanitization.',
+        remediation: 'Escape output, use textContent, or sanitize with DOMPurify / HTMLPurifier.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-79',
+    },
+    {
+        id: 'WEB_JWT_DECODE',
+        name: 'JWT decode without verify (auth bypass)',
+        regex: /jwt\.decode\s*\(/g,
+        severity: 'HIGH',
+        cvss: 8.1,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N',
+        description: 'jwt.decode() used instead of jwt.verify(). decode does NOT validate signature, allows forged tokens.',
+        remediation: 'Use jwt.verify(token, secret, {algorithms: ["HS256"]}) and explicitly set algorithm. Never trust decode.',
+        owasp: 'A02:2021 — Cryptographic Failures',
+        cwe: 'CWE-345',
+        falsePositiveIfContains: ['jwt.verify'],
+    },
+    {
+        id: 'WEB_CORS_WILDCARD',
+        name: 'CORS wildcard with credentials',
+        regex: /(?:origin\s*:\s*['"]\*['"]|Access-Control-Allow-Origin.*\*|cors\(\s*\{\s*origin\s*:\s*true)/gi,
+        severity: 'MEDIUM',
+        cvss: 6.5,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+        description: 'CORS configured with wildcard origin. If credentials:true, allows any site to read authenticated responses.',
+        remediation: 'Whitelist explicit origins: cors({origin: ["https://app.example.com"], credentials:true}). Never * with credentials.',
+        owasp: 'A01:2021 — Broken Access Control',
+        cwe: 'CWE-942',
+    },
+    {
+        id: 'WEB_EXEC_INJECTION',
+        name: 'Command injection via exec / spawn with user input',
+        regex: /(?:exec|execSync|spawn|spawnSync)\s*\(\s*[`'"].*\$\{.*req\.|exec\s*\(\s*.*\+.*req\.(?:body|query|params)/g,
+        severity: 'CRITICAL',
+        cvss: 9.8,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+        description: 'Child process exec with user-controlled input. Leads to RCE.',
+        remediation: 'Avoid shell. Use execFile with allowlist, or native libs (e.g., sharp instead of convert). Validate strict whitelist.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-77',
+    },
+    {
+        id: 'WEB_EVAL',
+        name: 'Code injection via eval / Function',
+        regex: /(?:\beval\s*\(|new\s+Function\s*\()/g,
+        severity: 'CRITICAL',
+        cvss: 9.8,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
+        description: 'eval() or new Function() with potential user input. Arbitrary code execution.',
+        remediation: 'Remove eval. Use JSON.parse, or safe alternatives. If unavoidable, strict allowlist and no user input.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-95',
+    },
+    {
+        id: 'WEB_MASS_ASSIGNMENT',
+        name: 'Mass assignment via req.body directly in create/update',
+        regex: /(?:\.create\s*\(\s*req\.body|\.update\s*\(\s*req\.body|\.findOneAndUpdate\s*\(\s*.*req\.body)/g,
+        severity: 'HIGH',
+        cvss: 8.1,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N',
+        description: 'Direct use of req.body in ORM create/update without whitelist. Allows role/balance elevation.',
+        remediation: 'Whitelist allowed fields: const {name,email} = req.body; Model.create({name,email}). Use ValidationPipe whitelist:true in NestJS.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-915',
+    },
+    {
+        id: 'WEB_NOSQL_INJECTION',
+        name: 'NoSQL injection via req.body in find',
+        regex: /(?:find|findOne)\s*\(\s*\{[^}]*req\.body\./g,
+        severity: 'HIGH',
+        cvss: 8.2,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N',
+        description: 'NoSQL query uses req.body field directly as filter. If attacker sends {$gt:""} it bypasses auth.',
+        remediation: 'Use String(req.body.username) or mongoSanitize. Validate types, strip $ operators.',
+        owasp: 'A03:2021',
+        cwe: 'CWE-943',
+    },
+    {
+        id: 'WEB_HELMET_MISSING',
+        name: 'Express app without helmet (missing security headers)',
+        fileRegex: /express\s*\(\)/,
+        severity: 'LOW',
+        cvss: 3.7,
+        cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N',
+        description: 'Express app detected but helmet middleware not used. Missing CSP, HSTS, X-Frame, etc.',
+        remediation: 'Add helmet: import helmet from "helmet"; app.use(helmet()); Configure CSP.',
+        owasp: 'A05:2021 — Security Misconfiguration',
+        cwe: 'CWE-693',
+        mustContain: ['express'],
+        falsePositiveIfContains: ['helmet'],
+    },
+    {
+        id: 'WEB_LARAVEL_DEBUG',
+        name: 'Laravel APP_DEBUG true in production example or .env',
+        regex: /APP_DEBUG\s*=\s*true/gi,
+        severity: 'MEDIUM',
+        cvss: 5.3,
+        cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N',
+        description: 'APP_DEBUG=true exposes stack traces, env vars.',
+        remediation: 'Set APP_DEBUG=false in production, APP_ENV=production. Ensure .env not committed.',
+        owasp: 'A05:2021',
+        cwe: 'CWE-215',
+    },
+];
+export function scanWeb(targetPath) {
+    if (!existsSync(targetPath))
+        throw new Error(`Target not found: ${targetPath}`);
+    const stat = statSync(targetPath);
+    let files = [];
+    if (stat.isFile())
+        files = [targetPath];
+    else
+        files = walkFiles(targetPath, ['.js', '.ts', '.jsx', '.tsx', '.vue', '.php', '.py', '.go', '.java']);
+    const findings = [];
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        if (content.length > 1_000_000)
+            continue;
+        const lines = content.split(/\r?\n/);
+        for (const pattern of WEB_PATTERNS) {
+            // Extension filter
+            if (pattern.extensions && pattern.extensions.length > 0) {
+                const ext = file.slice(file.lastIndexOf('.')).toLowerCase();
+                if (!pattern.extensions.includes(ext) && !pattern.extensions.some(e => file.endsWith(e))) {
+                    // allow if file contains mustContain anyway? Skip strict
+                    if (!pattern.mustContain)
+                        continue;
+                }
+            }
+            // mustContain filter
+            if (pattern.mustContain && !pattern.mustContain.some(k => content.includes(k)))
+                continue;
+            // false positive mitigation present
+            if (pattern.falsePositiveIfContains && pattern.falsePositiveIfContains.some(k => content.includes(k))) {
+                // For some patterns, we still want to report if mitigation not on same line? For simplicity skip file-level
+                // But for line-level, we check per line later; here we skip only for fileRegex patterns
+                if (pattern.fileRegex)
+                    continue;
+            }
+            if (pattern.fileRegex) {
+                pattern.fileRegex.lastIndex = 0;
+                if (pattern.fileRegex.test(content)) {
+                    // Find line of first match for file-level
+                    const match = content.match(pattern.fileRegex);
+                    let lineNum = 1;
+                    if (match && match.index !== undefined) {
+                        const before = content.slice(0, match.index);
+                        lineNum = before.split('\n').length;
+                    }
+                    findings.push({
+                        id: `VULN-${pattern.id}`,
+                        patternId: pattern.id,
+                        severity: pattern.severity,
+                        cvss: pattern.cvss,
+                        cvssVector: pattern.cvssVector,
+                        file,
+                        line: lineNum,
+                        match: match ? match[0].slice(0, 120) : pattern.id,
+                        description: pattern.description,
+                        remediation: pattern.remediation,
+                        owasp: pattern.owasp,
+                        cwe: pattern.cwe,
+                    });
+                }
+                continue;
+            }
+            if (!pattern.regex)
+                continue;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (line.length > 2000)
+                    continue;
+                pattern.regex.lastIndex = 0;
+                let m;
+                while ((m = pattern.regex.exec(line)) !== null) {
+                    const raw = m[0];
+                    if (raw.length < 4)
+                        continue;
+                    // Skip if mitigation on same line
+                    if (pattern.falsePositiveIfContains && pattern.falsePositiveIfContains.some(k => line.includes(k))) {
+                        // if mitigation present on same line, skip
+                        continue;
+                    }
+                    findings.push({
+                        id: `VULN-${pattern.id}`,
+                        patternId: pattern.id,
+                        severity: pattern.severity,
+                        cvss: pattern.cvss,
+                        cvssVector: pattern.cvssVector,
+                        file,
+                        line: i + 1,
+                        column: m.index,
+                        match: raw.slice(0, 200),
+                        description: pattern.description,
+                        remediation: pattern.remediation,
+                        owasp: pattern.owasp,
+                        cwe: pattern.cwe,
+                    });
+                    if (m[0].length === 0)
+                        pattern.regex.lastIndex++;
+                }
+            }
+        }
+    }
+    const seen = new Set();
+    const deduped = [];
+    for (const f of findings) {
+        const key = `${f.file}:${f.line}:${f.patternId}:${f.match}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            deduped.push(f);
+        }
+    }
+    const order = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, INFO: 4 };
+    deduped.sort((a, b) => order[a.severity] - order[b.severity] || a.file.localeCompare(b.file));
+    return deduped;
+}
+export function formatWebFindingsText(findings, target) {
+    if (findings.length === 0) {
+        return `✅ No web vulnerabilities found in ${target}\nChecked ${WEB_PATTERNS.length} patterns.\n`;
+    }
+    const bySev = {};
+    findings.forEach(f => bySev[f.severity] = (bySev[f.severity] || 0) + 1);
+    let out = `🕷️ Web scan results for ${target}\nTotal: ${findings.length} | ${Object.entries(bySev).map(([k, v]) => `${k}:${v}`).join(' ')}\n\n`;
+    for (const f of findings) {
+        const icon = f.severity === 'CRITICAL' ? '🔴' : f.severity === 'HIGH' ? '🟠' : f.severity === 'MEDIUM' ? '🟡' : '🟢';
+        out += `${icon} [${f.severity}] ${f.patternId} — ${f.file}:${f.line}\n`;
+        out += `   Match: ${f.match}\n`;
+        out += `   CVSS: ${f.cvss} ${f.cvssVector}\n`;
+        out += `   Fix: ${f.remediation.split('.')[0]}.\n\n`;
+    }
+    return out;
+}
+export { WEB_PATTERNS };

package/dist/scanners/web.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scanners/web.test.js

@@ -0,0 +1,67 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { scanWeb } from './web.js';
+describe('Web Scanner', () => {
+    let tmp;
+    beforeEach(() => {
+        tmp = mkdtempSync(join(tmpdir(), 'cyberaudit-web-'));
+    });
+    afterEach(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it('should detect SQLi concat', () => {
+        writeFileSync(join(tmp, 'db.js'), 'db.query("SELECT * FROM users WHERE id = " + req.query.id);');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_SQLI_CONCAT' || f.patternId === 'WEB_SQLI_RAW')).toBe(true);
+    });
+    it('should detect XSS dangerouslySetInnerHTML', () => {
+        writeFileSync(join(tmp, 'comp.jsx'), '<div dangerouslySetInnerHTML={{ __html: userInput }} />');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_XSS_DANGEROUS')).toBe(true);
+    });
+    it('should not flag XSS if DOMPurify present', () => {
+        writeFileSync(join(tmp, 'comp.jsx'), `
+      import DOMPurify from 'dompurify';
+      <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />
+    `);
+        const findings = scanWeb(tmp);
+        // Should be filtered because DOMPurify present
+        expect(findings.some(f => f.patternId === 'WEB_XSS_DANGEROUS')).toBe(false);
+    });
+    it('should detect jwt.decode', () => {
+        writeFileSync(join(tmp, 'auth.js'), 'const payload = jwt.decode(token);');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_JWT_DECODE')).toBe(true);
+    });
+    it('should detect CORS wildcard', () => {
+        writeFileSync(join(tmp, 'server.js'), "app.use(cors({ origin: '*' }));");
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_CORS_WILDCARD')).toBe(true);
+    });
+    it('should detect eval', () => {
+        writeFileSync(join(tmp, 'bad.js'), 'eval(userInput);');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_EVAL')).toBe(true);
+    });
+    it('should detect mass assignment', () => {
+        writeFileSync(join(tmp, 'user.js'), 'User.create(req.body);');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_MASS_ASSIGNMENT')).toBe(true);
+    });
+    it('should detect NoSQL injection', () => {
+        writeFileSync(join(tmp, 'login.js'), 'db.users.find({ username: req.body.username });');
+        const findings = scanWeb(tmp);
+        expect(findings.some(f => f.patternId === 'WEB_NOSQL_INJECTION')).toBe(true);
+    });
+    it('should return empty for clean file', () => {
+        writeFileSync(join(tmp, 'clean.js'), 'const a = 1; console.log(a);');
+        const findings = scanWeb(tmp);
+        expect(findings.length).toBe(0);
+    });
+    it('should have at least 10 patterns', async () => {
+        const { WEB_PATTERNS } = await import('./web.js');
+        expect(WEB_PATTERNS.length).toBeGreaterThanOrEqual(10);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberaudit-skill",
-  "version": "3.1.4",
+  "version": "3.2.0",
   "description": "Universal security audit skill for AI agents. Install once, audit any web or mobile app. OpenCode, Claude Code, Cursor, Kiro, Gemini — all supported.",
   "keywords": [
     "mcp",
@@ -38,9 +38,16 @@
     "build": "tsc",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
+    "dev:serve": "tsx src/mcp-server.ts",
     "install:local": "node dist/cli.js install",
     "install:all": "node dist/cli.js install --agent all",
-    "serve": "tsx src/mcp-server.ts",
+    "serve": "node dist/mcp-server.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src/",
+    "lint:fix": "eslint src/ --fix",
+    "format": "prettier --write \"src/**/*.{ts,js,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,js}\"",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
@@ -48,8 +55,13 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
+    "@typescript-eslint/parser": "^8.64.0",
+    "eslint": "^10.7.0",
+    "prettier": "^3.9.5",
     "tsx": "^4.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.1.10"
   },
   "engines": {
     "node": ">=18.0.0"

package/skills/cyberaudit/AGENT-BOOT.md

@@ -1,5 +1,5 @@
 # CYBERAUDIT SKILL — AGENT BOOT SEQUENCE
-Version: 3.0.0 LUNAIRE
+Version: 3.1.5
 Classification: UNIVERSAL SECURITY INTELLIGENCE
 
 ═══════════════════════════════════════════════════════════════

package/skills/cyberaudit/COMMANDS.md

@@ -71,6 +71,15 @@ When user types `/cyberaudit` or `/audit` — **list all commands below**.
 | `/audit:api:inventory` | API inventory/discovery |
 | `/audit:api:third-party` | Third-party API audit |
 
+## Cloud
+
+| Command | Action |
+|---|---|
+| `/audit:cloud` | Full cloud config audit (CIS, S3, IAM, SG) |
+| `/audit:cloud:s3` | Storage / buckets public access |
+| `/audit:cloud:iam` | IAM least privilege & wildcards |
+| `/audit:cloud:network` | Security Groups & firewall |
+
 ## Compliance
 
 | Command | Action |
@@ -80,7 +89,8 @@ When user types `/cyberaudit` or `/audit` — **list all commands below**.
 | `/audit:hipaa` | HIPAA compliance check |
 | `/audit:masvs` | MASVS 2.0 score |
 | `/audit:owasp` | OWASP Top 10 score |
+| `/audit:cis` | CIS Benchmark cloud score |
 
 ## Execution
 
-For any `/audit:xxx` command, load the corresponding files from `web/`, `mobile/`, `api/`, or `reports/`, then execute the audit methodology from `SKILL.md`.
+For any `/audit:xxx` command, load the corresponding files from `web/`, `mobile/`, `api/`, `cloud/`, or `reports/`, then execute the audit methodology from `SKILL.md`.

package/skills/cyberaudit/INSTALL.md

@@ -23,7 +23,7 @@ OPTION A — PROJECT-LOCAL (recommended for teams)
   All developers get access automatically.
 
   # In your project root directory
-  git clone https://github.com/yourname/cyberaudit-skill \
+  git clone https://github.com/ArisRoman/cyberaudit-skill \
     .skills/cyberaudit
 
   # Add to .gitignore if you don't want to commit it
@@ -42,7 +42,7 @@ OPTION B — MACHINE-GLOBAL (recommended for solo devs)
 
   # In your home directory
   mkdir -p ~/.skills
-  git clone https://github.com/yourname/cyberaudit-skill \
+  git clone https://github.com/ArisRoman/cyberaudit-skill \
     ~/.skills/cyberaudit
 
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -295,10 +295,10 @@ ANY OTHER AGENT (via API)
 ═══════════════════════════════════════════════════════════════
 
   Report an issue:
-    github.com/yourname/cyberaudit-skill/issues
+    github.com/ArisRoman/cyberaudit-skill/issues
 
   Suggest an improvement:
-    github.com/yourname/cyberaudit-skill/pulls
+    github.com/ArisRoman/cyberaudit-skill/pulls
 
   Add a new framework:
     Create web/frameworks/NEW-FRAMEWORK.md
@@ -306,6 +306,7 @@ ANY OTHER AGENT (via API)
     Add the command in COMMANDS.md
     Submit a PR
 
-  VERSION: 3.0.0 — LUNAIRE EDITION
+  VERSION: 3.1.5
   LICENSE: MIT
-  STANDARDS: OWASP Top 10 2023 · MASVS 2.0 · CVSS 3.1
+  STANDARDS: OWASP Top 10 2023 · MASVS 2.0 · CVSS 3.1 · CIS Cloud
+  REPO: github.com/ArisRoman/cyberaudit-skill

package/skills/cyberaudit/README.md

@@ -1,6 +1,6 @@
 # CyberAudit Skill
 
-Security audit intelligence for AI agents. Pure Markdown, zero dependencies.
+Security audit intelligence for AI agents. Pure Markdown, deterministic CLI + MCP.
 
 ## Coverage
 
@@ -8,22 +8,28 @@ Security audit intelligence for AI agents. Pure Markdown, zero dependencies.
 |---|---|
 | **Web** | 7 frameworks (React, Next.js, Laravel, NestJS, Express, Vue, Angular), 13 vulnerability types |
 | **Mobile** | 4 frameworks (React Native, Flutter, Ionic, Expo), 8 vulnerability types |
+| **API** | 3 types (REST, GraphQL, WebSocket), 5 vuln categories (BOLA, BOPLA, rate-limit, inventory, third-party) |
+| **Cloud** | S3 public, IAM wildcard, SG open, IMDSv1, secrets in IaC, CloudTrail (CIS benchmark) |
 | **Scoring** | CVSS 3.1 with aggravating/mitigating context factors |
-| **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2 |
-| **Reports** | Web + Mobile + Executive Summary templates |
+| **Compliance** | RGPD, PCI-DSS, HIPAA, SOC 2, CIS |
+| **Reports** | Web + Mobile + API + Cloud + Executive Summary templates |
+| **Commands** | 60 slash-commands (`/audit:web`, `/audit:cloud:s3`, etc.) |
 
 ## Files
 
 ```
 AGENT-BOOT.md      Boot sequence, oath, audit levels
 SKILL.md           Main intelligence, taxonomy, rules
-COMMANDS.md        Operational commands
+COMMANDS.md        Operational commands (60 commands)
 USAGE-GUIDE.md     User-facing guide
 MASTER.md          Full vulnerability taxonomy + scoring
 web/               Web audit checklists, per-framework guides
 mobile/            Mobile audit checklists, per-framework guides
+api/               API checklists + type guides
+cloud/             Cloud checklists, philosophy, remediation (S3, IAM, SG)
 shared/            Scoring, CVSS, OWASP mapping, compliance
-reports/           Report templates (web, mobile, executive)
+reports/           Report templates (web, mobile, api, cloud, executive)
+commands/          60 command definitions for OpenCode autocomplete
 ```
 
 ## Audit Levels
@@ -39,6 +45,15 @@ reports/           Report templates (web, mobile, executive)
 npx -y cyberaudit-skill install
 ```
 
+## CLI
+
+```bash
+npx -y cyberaudit-skill list
+npx -y cyberaudit-skill install --dry-run
+npx -y cyberaudit-skill serve # MCP server
+npm test # 14 tests
+```
+
 ## License
 
 MIT

package/skills/cyberaudit/SKILL.md

@@ -9,7 +9,7 @@ description: >
 compatibility: Pure Markdown skill, no external dependencies. Works with any AI agent that loads SKILL.md.
 metadata:
   author: ArisRoman
-  version: "3.0"
+  version: "3.1.5"
   allowed-tools: Read Edit Grep Glob Bash
 ---
 
@@ -84,6 +84,14 @@ Security audit intelligence for AI agents. Universal, framework-agnostic, method
 | `/audit:api:inventory` | API inventory/discovery |
 | `/audit:api:third-party` | Third-party API audit |
 
+### Cloud
+| Command | Action |
+|---|---|
+| `/audit:cloud` | Full cloud config audit (S3, IAM, SG) |
+| `/audit:cloud:s3` | Storage security (public buckets) |
+| `/audit:cloud:iam` | IAM privilege audit |
+| `/audit:cloud:network` | Security groups & network audit |
+
 ### Compliance
 | Command | Action |
 |---|---|
@@ -92,28 +100,30 @@ Security audit intelligence for AI agents. Universal, framework-agnostic, method
 | `/audit:hipaa` | HIPAA compliance check |
 | `/audit:masvs` | MASVS 2.0 score |
 | `/audit:owasp` | OWASP Top 10 score |
+| `/audit:cis` | CIS Benchmark cloud score |
 
 ## Boot Sequence
 
 Execute on every audit request:
 
 **STEP 1 — IDENTIFICATION** (30 sec)
-- TYPE → Web / Mobile / API / Both
-- FRAMEWORK → Identify precisely (React, Laravel, Flutter, etc.)
+- TYPE → Web / Mobile / API / Cloud / Both
+- FRAMEWORK → Identify precisely (React, Laravel, Flutter, Terraform, etc.)
 - CONTEXT → Dev / Staging / Production
-- SCOPE → Entire code / Single module
+- SCOPE → Entire code / Single module / IaC
 - URGENCY → Quick scan / Standard / Deep / Red Team
 
 **STEP 2 — MODE LOADING**
 - Web → Load web checklist + framework-specific guide
 - Mobile → Load mobile checklist + framework-specific guide
 - API → Load API checklist + type-specific guide (REST/GraphQL/WebSocket)
+- Cloud → Load cloud checklist + philosophy (AWS/GCP/Azure)
 
 **STEP 3 — STRUCTURED AUDIT**
 Follow the loaded philosophy. Never skip a phase. Document each finding immediately.
 
 **STEP 4 — REPORT**
-Use template. CVSS 3.1 scoring. Complete remediation code for each finding.
+Use template (web/mobile/api/cloud). CVSS 3.1 scoring. Complete remediation code for each finding.
 
 ## Universal Principles
 
@@ -255,7 +265,12 @@ This skill lives at `~/.skills/cyberaudit/`. Additional sub-skills:
 │   ├── REPORT-TEMPLATE-WEB.md
 │   ├── REPORT-TEMPLATE-MOBILE.md
 │   ├── REPORT-TEMPLATE-API.md
+│   ├── REPORT-TEMPLATE-CLOUD.md
 │   └── EXECUTIVE-SUMMARY-TEMPLATE.md
+├── cloud/
+│   ├── CLOUD-CHECKLIST.md
+│   ├── CLOUD-PHILOSOPHY.md
+│   └── CLOUD-REMEDIATION-LIBRARY.md
 ├── shared/
 │   ├── COMPLIANCE.md
 │   ├── CVSS-GUIDE.md