cyberaudit-skill 3.1.5 → 3.2.0

package/skills/cyberaudit/cloud/CLOUD-CHECKLIST.md

@@ -0,0 +1,85 @@
+# ✅ CLOUD CHECKLIST — CYBERAUDIT SKILL
+# OWASP Cloud / CIS Benchmark aligned
+
+═══════════════════════════════════════════════════════════════
+  INSTRUCTIONS: Check each item. Document ❌.
+  ✅ = Conforming  ❌ = Finding  ⚠️ = Context-dependent
+═══════════════════════════════════════════════════════════════
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 1 — STORAGE (S3, GCS, Blob)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ No bucket/container publicly readable (ACL: private)
+  □ No bucket with public ACL + ListObjects
+  □ No bucket policy with Principal: "*"
+  □ Versioning enabled for critical buckets
+  □ Encryption at rest (SSE-S3 / SSE-KMS / CMK)
+  □ No sensitive data (keys, .env, backups) in bucket
+  □ Lifecyle / retention defined, no infinite public snapshots
+  □ Signed URLs with short expiry, not permanent public URLs
+  □ Logging enabled (S3 access logs / CloudTrail data events)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 2 — IAM & PRIVILEGES
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ No wildcard (*) in Action + Resource
+  □ No admin (*) policies attached to app role/user
+  □ Least privilege: role per service, not one god-role
+  □ No long-lived access keys in repo / env / IaC
+  □ Access keys rotated <90 days, unused removed
+  □ MFA enforced for console, especially root/admin
+  □ IAM: no password auth without MFA
+  □ Service accounts / roles with trust policy restrictive
+    (no sts:AssumeRole from "*")
+  □ Permission boundaries in place for delegated roles
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 3 — NETWORK & SECURITY GROUPS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ No SG 0.0.0.0/0 → 22 (SSH) or 3389 (RDP)
+  □ No SG 0.0.0.0/0 → 6379 (Redis), 27017 (Mongo), 5432, 3306
+  □ No SG 0.0.0.0/0 → sensitive ports (internal ALB, etc.)
+  □ ALB/NLB: TLS 1.2+ only, not TLS 1.0/1.1
+  □ No ELB with HTTP listener forwarding secrets
+  □ VPC: private subnets for DB/cache, public only for LB
+  □ Flow logs enabled
+  □ No IGW route to private subnets
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 4 — SECRETS & ENV
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ No secrets in Terraform / CloudFormation / ARM plain
+  □ Secrets stored in Secrets Manager / Parameter Store / KeyVault
+  □ No .env file committed, no secret in user-data / startup-script
+  □ KMS CMK used for sensitive encryption, rotation enabled
+  □ No hard-coded secrets in Lambda env vars (use Secrets Manager)
+  □ No API keys in frontend / mobile bundled
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 5 — LOGGING & MONITORING
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ CloudTrail / Audit Log enabled, multi-region, encrypted
+  □ No CloudTrail bucket public
+  □ Alerts: root login, IAM changes, SG changes, bucket policy changes
+  □ GuardDuty / Security Center / Defender for Cloud enabled
+  □ Config / Policy Analyzer enabled for compliance drift
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 6 — COMPUTE (EC2, Lambda, Cloud Run)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ No IMDSv1 (enforce IMDSv2) → blocks SSRF → 169.254.169.254
+  □ No Lambda with public Function URL without auth
+  □ No EC2 with public IP + open SG + IAM god-role (SSRF pivot)
+  □ Runtime updated, no EOL (Node 14, Python 3.8, etc.)
+  □ No debug endpoints in prod (/debug, /console)
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 7 — IaC & SUPPLY CHAIN
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  □ Terraform state not public, encrypted (S3 + DynamoDB lock)
+  □ No tfvars with secrets committed
+  □ IaC scanned (checkov, tfsec, cfn-nag) — 0 critical
+  □ Provider versions pinned, not *
+  □ No public ECR/GCR images with secrets in layers
+
+SCORE : [___ compliant items] / [___ applicable items] = ____%

package/skills/cyberaudit/cloud/CLOUD-PHILOSOPHY.md

@@ -0,0 +1,91 @@
+# ☁️ CLOUD AUDIT PHILOSOPHY — CYBERAUDIT SKILL
+# The mindset for cloud configuration audit
+
+═══════════════════════════════════════════════════════════════
+                    CLOUD MENTAL MODEL
+═══════════════════════════════════════════════════════════════
+
+CLOUD = Someone else's computer that you configure with text.
+Every line of IaC is a security decision.
+
+PRINCIPLE 1 — IDENTITY IS THE NEW PERIMETER
+  In cloud, network is not perimeter, IAM is.
+  Ask: "Who can assume this role? With what privilege? From where?"
+  Wildcard (*) = breach.
+
+PRINCIPLE 2 — STORAGE IS PUBLIC UNTIL PROVEN PRIVATE
+  Default to private. Verify:
+  - ACL, bucket policy, public access block, IAM, URL signed.
+  One public = data breach.
+
+PRINCIPLE 3 — METADATA IS SECRET
+  169.254.169.254 is the cloud crown jewel.
+  SSRF → metadata → credentials → privilege escalation.
+  Fix: IMDSv2 enforced, no SSRF, scoped IAM.
+
+PRINCIPLE 4 — EVERYTHING IS LOGGED OR IT DIDN'T HAPPEN
+  Without CloudTrail / Audit Log, you can't detect, can't respond.
+  Log all control-plane + data-plane critical.
+
+PRINCIPLE 5 — IaC IS CODE, SCAN IT
+  Terraform, CloudFormation, Helm are attack surface.
+  Scan with checkov/tfsec/cfn-nag in CI.
+
+═══════════════════════════════════════════════════════════════
+                    AUDIT FLOW
+═══════════════════════════════════════════════════════════════
+
+PHASE 0 — ENUMERATION
+  □ Provider? AWS / GCP / Azure / multi
+  □ IaC present? Terraform / CDK / SAM / Bicep / Pulumi
+  □ Inventory: buckets, IAM roles/users, SG/Firewall, Lambdas, K8s
+  □ Sensitive data classification (PII, financial, keys)
+
+PHASE 1 — STORAGE AUDIT
+  List all buckets/containers. For each:
+  - Is it public? (check 4 layers: ACL, policy, BlockPublicAccess, IAM)
+  - Encryption at rest?
+  - Contains secrets? Search .env, .sql, backup.zip
+  - Logging?
+
+PHASE 2 — IAM AUDIT
+  For each role/user/policy:
+  - Does it have *:* ?
+  - Trust policy overly permissive?
+  - Access keys age?
+  - MFA?
+  → Craft attack path: compromised EC2/Lambda → what IAM allows?
+
+PHASE 3 — NETWORK AUDIT
+  - SG / Firewall rules 0.0.0.0/0 ?
+  - Public IPs?
+  - TLS version?
+  - VPC architecture (public vs private)
+
+PHASE 4 — SECRETS & COMPUTE
+  - Secrets in env vars, user-data, tfvars?
+  - IMDSv1 enabled?
+  - Lambda public URL?
+
+PHASE 5 — LOGGING & DETECTION
+  - CloudTrail enabled + encrypted + not public?
+  - Alerts on IAM/SG/bucket changes?
+
+═══════════════════════════════════════════════════════════════
+                    KILL CHAINS
+═══════════════════════════════════════════════════════════════
+
+Chain 1 — Public S3 → Data Breach
+  Dev puts backup.sql in s3://app-prod-backup public.
+  Attacker: s3 ls → download → credentials → full compromise.
+
+Chain 2 — SSRF → IAM escalation
+  Web app: fetch user URL without whitelist.
+  Attacker: url=http://169.254.169.254/latest/meta-data/iam/security-credentials/role
+  → gets temporary AWS creds → with iam:* → takeover account.
+
+Chain 3 — Wildcard IAM → PrivEsc
+  Lambda role has s3:* on *.
+  Attacker compromises Lambda via injection → lists all buckets → reads secrets.
+
+Fix: scope IAM, enforce IMDSv2, validate URLs, least privilege.

package/skills/cyberaudit/cloud/CLOUD-REMEDIATION-LIBRARY.md

@@ -0,0 +1,145 @@
+# ☁️ CLOUD REMEDIATION LIBRARY — CYBERAUDIT SKILL
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+PUBLIC S3 BUCKET
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+DETECT:
+  aws s3api get-public-access-block --bucket X
+  aws s3api get-bucket-acl --bucket X
+  aws s3api get-bucket-policy --bucket X
+
+FIX Terraform:
+```hcl
+resource "aws_s3_bucket_public_access_block" "block" {
+  bucket = aws_s3_bucket.app.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+resource "aws_s3_bucket_server_side_encryption_configuration" "enc" {
+  bucket = aws_s3_bucket.app.id
+  rule { apply_server_side_encryption_by_default { sse_algorithm = "aws:kms", kms_master_key_id = aws_kms_key.s3.arn } }
+}
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+WILDCARD IAM
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+DETECT:
+  iam:* , s3:* on Resource "*"
+
+FIX — Least privilege example:
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["s3:GetObject"],
+    "Resource": "arn:aws:s3:::app-prod-uploads/user/${aws:userid}/*"
+  }]
+}
+```
+Terraform scope:
+```hcl
+resource "aws_iam_policy" "scoped" {
+  policy = jsonencode({
+    Statement = [{ Action = ["s3:GetObject","s3:PutObject"], Resource = "${aws_s3_bucket.uploads.arn}/*" }]
+  })
+}
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+OPEN SECURITY GROUP
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+FIX:
+```hcl
+# ❌ Before
+ingress { from_port=22 to_port=22 protocol="tcp" cidr_blocks=["0.0.0.0/0"] }
+
+# ✅ After — bastion only
+ingress { from_port=22 to_port=22 protocol="tcp" security_groups=[aws_security_group.bastion.id] }
+
+# Redis/Mongo never public
+# Use private subnet + SecurityGroup only app SG
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SSRF → IMDS CREDENTIAL THEFT
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+FIX 1 — Enforce IMDSv2 on EC2:
+```hcl
+resource "aws_instance" "app" {
+  metadata_options {
+    http_tokens = "required" # enforce v2
+    http_endpoint = "enabled"
+  }
+}
+```
+FIX 2 — Block metadata in app:
+```ts
+// URL validation before fetch
+const ALLOWED = ["api.stripe.com","api.example.com"];
+const url = new URL(userInput);
+if (!ALLOWED.includes(url.hostname)) throw new Error("Domain not allowed");
+if (url.hostname === "169.254.169.254" || url.hostname === "metadata.google.internal") throw new Error("Blocked");
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECRETS IN IaC / ENV
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+FIX:
+```hcl
+# ❌ Don't
+resource "aws_ssm_parameter" "secret" { value = "supersecret" }
+
+# ✅ Use Secrets Manager
+resource "aws_secretsmanager_secret" "api_key" { name = "prod/api-key" }
+# Reference in Lambda via extension or SDK, not env plaintext
+```
+
+For Terraform state:
+```hcl
+terraform {
+  backend "s3" {
+    bucket = "tf-state-prod"
+    key    = "app/terraform.tfstate"
+    region = "eu-west-1"
+    encrypt = true
+    dynamodb_table = "tf-lock"
+  }
+}
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+LAMBDA PUBLIC URL
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+FIX:
+```hcl
+# Require IAM auth
+resource "aws_lambda_function_url" "url" {
+  authorization_type = "AWS_IAM" # not NONE
+}
+```
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+CLOUDTRAIL NOT ENABLED
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+FIX:
+```hcl
+resource "aws_cloudtrail" "main" {
+  name = "org-trail"
+  s3_bucket_name = aws_s3_bucket.trail.id
+  is_multi_region_trail = true
+  enable_logging = true
+  kms_key_id = aws_kms_key.trail.arn
+}
+```
+Enable alert:
+```hcl
+resource "aws_cloudwatch_metric_alarm" "root" {
+  alarm_name = "RootLogin"
+  metric_name = "RootLogin"
+  # ... filter CloudTrail root login
+}
+```

package/skills/cyberaudit/commands/audit-angular.md

@@ -0,0 +1,11 @@
+---
+description: Angular-specific audit
+---
+Angular-specific audit — /audit:angular
+
+1. Load web/frameworks/ANGULAR.md
+2. Check bypassSecurityTrust with user input, innerHTML, strict guards
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-bola.md

@@ -0,0 +1,11 @@
+---
+description: BOLA/IDOR audit (API)
+---
+BOLA/IDOR audit (API) — /audit:api:bola
+
+1. Load api/vulnerabilities/BOLA.md
+2. Test sequential ID replacement, ownership verification
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-bopla.md

@@ -0,0 +1,11 @@
+---
+description: BOPLA (BFLA) audit
+---
+BOPLA (BFLA) audit — /audit:api:bopla
+
+1. Load api/vulnerabilities/BOPLA.md
+2. Test admin functions with normal user token, vertical escalation
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-graphql.md

@@ -0,0 +1,11 @@
+---
+description: GraphQL API audit
+---
+GraphQL API audit — /audit:api:graphql
+
+1. Load api/types/GRAPHQL.md
+2. Check introspection disabled in prod, depth/complexity limits, batching attacks, per-resolver auth
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-inventory.md

@@ -0,0 +1,11 @@
+---
+description: API inventory/discovery audit
+---
+API inventory/discovery audit — /audit:api:inventory
+
+1. Load api/vulnerabilities/INVENTORY.md
+2. Check shadow endpoints, v0/v1, debug endpoints, OpenAPI spec exposed
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-rate-limit.md

@@ -0,0 +1,11 @@
+---
+description: Rate limiting audit (API)
+---
+Rate limiting audit (API) — /audit:api:rate-limit
+
+1. Load api/vulnerabilities/RATE-LIMITING.md
+2. Check login, register, reset rate limits, 429 with Retry-After
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-rest.md

@@ -0,0 +1,11 @@
+---
+description: REST API audit
+---
+REST API audit — /audit:api:rest
+
+1. Load api/types/REST.md
+2. Check IDOR on every ID, mass assignment whitelist, over-fetching, deprecated v0 endpoints
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-third-party.md

@@ -0,0 +1,11 @@
+---
+description: Third-party API audit
+---
+Third-party API audit — /audit:api:third-party
+
+1. Load api/vulnerabilities/THIRD-PARTY-API.md
+2. Check outgoing HTTPS, cert validation, timeouts, webhook HMAC, data treated as untrusted
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-api-ws.md

@@ -0,0 +1,11 @@
+---
+description: WebSocket API audit
+---
+WebSocket API audit — /audit:api:ws
+
+1. Load api/types/WEBSOCKET.md
+2. Check auth on connect, per-message auth, origin validation, rate limiting, WSS only
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-auth-api.md

@@ -0,0 +1,11 @@
+---
+description: API authentication & authorization audit
+---
+API authentication & authorization audit — /audit:auth-api
+
+1. Load api/vulnerabilities/BOLA.md and BOPLA.md
+2. Check JWT verify not decode, ownership per resource, admin endpoints protected
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-auth-mobile.md

@@ -0,0 +1,11 @@
+---
+description: Mobile authentication audit
+---
+Mobile authentication audit — /audit:auth-mobile
+
+1. Load mobile/vulnerabilities/AUTH-MOBILE.md
+2. Check token storage in Keychain, refresh rotation, biometrics linked to crypto key
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-auth.md

@@ -0,0 +1,12 @@
+---
+description: Authentication & Authorization audit (web)
+---
+Authentication & Authorization audit (web) — /audit:auth
+
+1. Load WEB-PHILOSOPHY.md
+2. Load web/vulnerabilities/AUTH-AUTHZ.md
+3. Check: password hashing, JWT verify, session regen, OAuth state, MFA, RBAC on every endpoint
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-binary.md

@@ -0,0 +1,11 @@
+---
+description: Binary analysis audit (mobile)
+---
+Binary analysis audit (mobile) — /audit:binary
+
+1. Load mobile/vulnerabilities/BINARY-ANALYSIS.md
+2. Check hardcoded API keys, debug mode, ProGuard/R8, source maps not in prod
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-cis.md

@@ -0,0 +1,11 @@
+---
+description: CIS Benchmark cloud score
+---
+CIS Benchmark cloud score — /audit:cis
+
+1. Load cloud/CLOUD-CHECKLIST.md
+2. Map to CIS AWS/GCP/Azure controls, produce compliance table
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-cloud-iam.md

@@ -0,0 +1,11 @@
+---
+description: IAM least privilege & wildcards audit
+---
+IAM least privilege & wildcards audit — /audit:cloud:iam
+
+1. Load cloud/CLOUD-CHECKLIST.md SECTION 2
+2. Check wildcard Action/Resource, admin policies, access key rotation, MFA, trust policy *
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-cloud-network.md

@@ -0,0 +1,11 @@
+---
+description: Security Groups & firewall audit
+---
+Security Groups & firewall audit — /audit:cloud:network
+
+1. Load cloud/CLOUD-CHECKLIST.md SECTION 3
+2. Check 0.0.0.0/0:22, 6379, DB ports, TLS version, flow logs, private subnets
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-cloud-s3.md

@@ -0,0 +1,11 @@
+---
+description: Cloud storage / buckets public access audit
+---
+Cloud storage / buckets public access audit — /audit:cloud:s3
+
+1. Load cloud/CLOUD-CHECKLIST.md SECTION 1
+2. Check bucket public ACL, policy Principal *, encryption, versioning, logs
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-cloud.md

@@ -0,0 +1,10 @@
+---
+description: Cloud configuration audit — S3, IAM, security groups, secrets, CIS benchmark
+---
+Run a cloud configuration security audit.
+1. Load cloud/CLOUD-PHILOSOPHY.md for methodology
+2. Load cloud/CLOUD-CHECKLIST.md for full checklist
+3. Scan IaC (Terraform, CloudFormation, etc.) or live config
+4. Execute phases: storage, IAM, network, secrets, logging
+5. Score each finding with CVSS 3.1
+6. Generate report using reports/REPORT-TEMPLATE-CLOUD.md

package/skills/cyberaudit/commands/audit-cors.md

@@ -0,0 +1,11 @@
+---
+description: CORS configuration audit
+---
+CORS configuration audit — /audit:cors
+
+1. Load web/vulnerabilities/CORS.md
+2. Check Allow-Origin *, credentials true + *, whitelist validation
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-crypto-mobile.md

@@ -0,0 +1,11 @@
+---
+description: Mobile cryptography audit
+---
+Mobile cryptography audit — /audit:crypto-mobile
+
+1. Load mobile/vulnerabilities/CRYPTO-MOBILE.md
+2. Check AES-256-GCM, no hardcoded keys, IV unique, Keystore
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-crypto.md

@@ -0,0 +1,10 @@
+---
+description: Web cryptography audit
+---
+Web cryptography audit — /audit:crypto
+
+1. Load WEB-CHECKLIST.md section 14, check AES-256-GCM, bcrypt/argon2, no MD5/SHA1, IV unique, secure random
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-csrf.md

@@ -0,0 +1,11 @@
+---
+description: CSRF audit
+---
+CSRF audit — /audit:csrf
+
+1. Load web/vulnerabilities/CSRF.md
+2. Check CSRF tokens on POST, SameSite cookie, webhook HMAC
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-deeplinks.md

@@ -0,0 +1,11 @@
+---
+description: Deep links & IPC audit
+---
+Deep links & IPC audit — /audit:deeplinks
+
+1. Load mobile/vulnerabilities/IPC-DEEPLINKS.md
+2. Check App Links vs custom schemes, param validation, auth before sensitive deep link
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-deps.md

@@ -0,0 +1,11 @@
+---
+description: Dependencies & supply chain audit
+---
+Dependencies & supply chain audit — /audit:deps
+
+1. Load web/vulnerabilities/SUPPLY-CHAIN.md
+2. Run npm audit / composer audit, check lock files, outdated frameworks, abandoned deps
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-deserial.md

@@ -0,0 +1,11 @@
+---
+description: Insecure deserialization audit
+---
+Insecure deserialization audit — /audit:deserial
+
+1. Load web/vulnerabilities/DESERIALIZATION.md
+2. Check unserialize with user input, gadget chains, signed serialization
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-exec.md

@@ -0,0 +1,11 @@
+---
+description: Generate executive summary
+---
+Generate executive summary — /audit:exec
+
+1. Load reports/EXECUTIVE-SUMMARY-TEMPLATE.md
+2. Summarize business risks, immediate actions
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.

package/skills/cyberaudit/commands/audit-expo.md

@@ -0,0 +1,11 @@
+---
+description: Expo audit
+---
+Expo audit — /audit:expo
+
+1. Load mobile/frameworks/EXPO.md
+2. Check build config, permissions, update channel tampering
+
+Output:
+- Findings with [VULN-...] numbering, CVSS 3.1 vector, file:line, vulnerable code, fixed code, references.
+- Use templates from reports/ if needed.