代码安全审计

security-audit

代码安全审计 - 漏洞扫描、依赖检查、安全最佳实践

laolaoshiren/claude-code-skills-zh·0installs876starsSecurity

SKILL.md

Full skill instructions

代码安全审计

触发条件

当用户要求安全检查、漏洞扫描、安全审计、依赖安全检查时激活此技能。

工作流程

确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
静态安全扫描 — 按检查清单逐项排查
依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
生成审计报告 — 按严重程度分类输出

检查清单

🔴 高危

硬编码密钥/密码/API Key
SQL 注入风险（字符串拼接 SQL）
命令注入（未过滤的 shell 命令）
路径遍历（未校验的文件路径）
反序列化漏洞
未校验的 JWT/Token 验证

🟡 中危

XSS 风险（未转义的用户输入）
CSRF 保护缺失
不安全的随机数生成
敏感信息日志泄露
过宽的权限设置
缺少 Rate Limiting

🟢 低危

缺少输入验证
依赖版本过旧
缺少安全头部（CSP, HSTS, X-Frame-Options）
错误信息泄露内部细节
缺少 HTTPS 强制

输出格式

## 🔒 安全审计报告

### 审计概览
- 审计范围：xxx
- 发现问题：🔴 高危 X 个 / 🟡 中危 X 个 / 🟢 低危 X 个

### 🔴 高危问题
#### 1. [文件路径:行号]
- **漏洞类型**：xxx
- **风险描述**：xxx
- **攻击场景**：攻击者可以通过 xxx 方式...
- **修复方案**：
  ```code
  // 修复前
  // 修复后

🟡 中危问题

...

🟢 低危问题

...

依赖安全

依赖名	当前版本	建议版本	风险

修复优先级建议

立即修复：...
本周修复：...
长期改进：...


## 注意事项
- 提供修复前后的代码对比
- 对于每条漏洞，说明具体的攻击向量
- 优先级基于可利用性和影响范围判断

Install skill

Copy and run in your terminal

npx -y skills add https://github.com/laolaoshiren/claude-code-skills-zh --skill security-audit

View on GitHub

security-audit

More Security skills

View all

Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K

View

Security

neon-postgres

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K

View

Security

firebase-auth-basics

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K

View

Security

firebase-security-rules-auditor

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K

View

Security

firebase-ai-logic-basics

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K

View

Security

better-auth-best-practices

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K

View

Security

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K

View

Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K

View

Security

azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K

View