AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载本文以 agentic-awesome-skills 仓库中 007 安全审计技能SKILL 007所维护的 owasp-checklists.md 为骨架系统梳理 OWASP Web Application Top 102021、OWASP API Security Top 102023与 OWASP LLM Top 102025三套清单的漏洞定义、典型检测模式与修复要点并对照 007 技能附带的扫描器源码config.py、injection_scanner.py、secrets_scanner.py 等说明如何把清单条目落地为可重复执行的自动化检查。读完本文你可以把三套 OWASP 清单直接用于日常代码评审、安全审计与威胁建模并借助 007 的脚本把其中可自动化的部分密钥泄露、注入、依赖漏洞变成 CI 前的快速扫描。一、这份清单在 007 技能中的定位007 是仓库 007 技能目录 下定义的安全审计、加固、威胁建模STRIDE/PASTA、红蓝队、OWASP 检查、代码评审、事件响应与基础设施安全综合技能。其完整执行流程记录在 detailed-guide.md 中共六个阶段FASE 1 FASE 2 FASE 3 FASE 4 FASE 5 FASE 6 Mapeamento - Threat Model - Checklist - Red Team - Blue Team - Veredito (Superficie) (STRIDEPASTA) (Tecnico) (Ataque) (Defesa) (Final)其中Fase 3技术检查清单是整个流程的承上启下环节在 Fase 1 完成攻击面测绘、Fase 2 完成 STRIDE/PASTA 威胁建模之后用它把威胁模型映射到具体可验证的检查项而本文主角——owasp-checklists.md——正是该阶段用于对照漏洞类别的核心参考表覆盖了从传统 Web 应用到现代 API、再到 LLM/Agent 系统的三类风险面。在 detailed-guide.md 中007 技能把检查清单按系统类型分成四组Universal通用密钥不入库、最小权限、全部外部输入校验、限流与反滥用、外部调用超时、成本/资源上限、关键操作审计日志、监控告警、fail-safe、备份回滚、依赖无关键 CVE、全站 HTTPS。Python 专属无eval()/exec()外部输入、无pickle反序列化不可信数据、subprocess使用shellFalse、requests使用verifyTrue并设置超时、venv 隔离、依赖 pin 版本与哈希。APIs所有端点鉴权除 health check、按资源授权RBAC/ABAC、payload schema 校验、写操作幂等、防重放nonce/timestamp、webhook 签名校验、CORS 严格配置、安全响应头、SSRF/IDOR/注入防护。IA/Agentesprompt injection 防护、jailbreak 防护guardrails、content filter、Agent 间上下文隔离、按 Agent 限制工具集最小权限、单次执行迭代/成本上限、用户代码必须沙箱执行。本文三张 OWASP 清单恰好为上述分组提供了漏洞分类 检测模式 修复动作的底层索引。二、OWASP Web Application Top 102021经典 Web 风险面这张表适用于大多数传统 Web 应用与后端服务的代码评审。每一项都给出漏洞描述 / 检测模式 / 修复方式三段信息可直接在 Review 时逐条对照。#VulnerabilityDescriptionDetection PatternsFixA01Broken Access ControlUsers can act outside their intended permissions. IDOR, missing authz checks, CORS misconfiguration.GET /adminaccessible without admin role; user A accesses user B data via ID manipulation; missingrequire_roledecorators.Deny by default. Enforce server-side access control. Disable directory listing. Log access failures. Invalidate JWT/sessions on logout.A02Cryptographic FailuresSensitive data exposed due to weak or missing encryption. Cleartext storage/transmission.Passwords stored as MD5/SHA1; HTTP endpoints serving sensitive data; hardcoded encryption keys;TLS 1.0/1.1in config.HTTPS everywhere. TLS 1.2 only. bcrypt/argon2 for passwords. Encrypt data at rest (AES-256). No sensitive data in URLs.A03InjectionUntrusted data sent to interpreter without validation. SQL, NoSQL, OS command, LDAP injection.String concatenation in queries:fSELECT * FROM users WHERE id{input};os.system(user_input); unsanitized template rendering.Parameterized queries/prepared statements. ORM usage. Input validation (allowlist). Escape output. WAF as defense-in-depth.A04Insecure DesignMissing or ineffective security controls at design level. Threat modeling not performed.No rate limit on password reset; unlimited free trial creation; business logic allows negative quantities; no fraud detection.Threat model during design. Secure design patterns. Unit/integration tests for abuse cases. Limit resource consumption by user.A05Security MisconfigurationDefault configs, open cloud storage, unnecessary features enabled, verbose errors.Default admin credentials; S3 bucket public; stack traces in production; unnecessary HTTP methods enabled; CORS*.Hardened defaults. Remove unused features/frameworks. Automated config scanning. Different credentials per environment.A06Vulnerable ComponentsUsing libraries/frameworks with known vulnerabilities. Outdated dependencies.npm audit/pip-auditfindings; CVE matches in dependency tree; EOL runtime versions; unpatched OS packages.Dependency scanning in CI/CD. Automated updates (Dependabot/Renovate). Remove unused dependencies. Monitor CVE databases.A07Auth FailuresBroken authentication allows credential stuffing, brute force, session hijacking.No rate limit on login; session ID in URL; no MFA option; weak password policy; session not invalidated on password change.MFA. Rate limit login attempts. Secure session management. Strong password policy. Rotate session on privilege change.A08Software/Data IntegrityInsecure CI/CD pipelines, unsigned updates, deserialization of untrusted data.pickle.loads(user_data); CDN scripts without SRI hashes; unsigned artifacts in pipeline; auto-merge without review.SRI for external scripts. Signed artifacts. Review CI/CD pipeline security. Avoid deserializing untrusted data. Code review enforcement.A09Logging/Monitoring FailuresInsufficient logging, missing alerts, no incident response capability.No logs for login failures; logs without user context; no alerting on suspicious patterns; logs stored locally only.Log all auth events, access failures, input validation failures. Centralized logging. Alert on anomalies. Retention policy.A10SSRFServer-side request forgery - application fetches attacker-controlled URL.fetch(user_provided_url); URL parameter for image processing; webhook URL without validation; DNS rebinding.Allowlist for outbound URLs/IPs. Block private IP ranges (10.x, 172.16.x, 169.254.x). Disable HTTP redirects. Network segmentation.源码印证A03 注入与 A08 反序列化的自动化检测在 007 技能中A03/A08 并非仅靠人工 Review而是有正则引擎直接扫描。见 config.py 中DANGEROUS_PATTERNS的定义SQL 注入指标sql_string_formatexecute(cursor.execute)后跟含{的 f-string等级 CRITICAL、sql_percent_format%s格式化等级 MEDIUM危险反序列化pickle_loadsHIGH、marshal_loadsMEDIUM、shelve_openMEDIUM命令执行os_system/os_popenHIGH、subprocess_shell_true/shell_injectionCRITICAL前端 XSS 指标innerHTML_assignmentHIGH、js_evalCRITICAL。更细化的注入扫描见 injection_scanner.py它对每一条命中会做上下文感知的降级处理若危险调用只使用硬编码字面量如eval(11)则降为 INFO若所在行及其前后 5 行内出现用户输入来源request.args、sys.argv、input(等则标记为[TAINTED]并保持高严重度测试文件中的命中整体降一级。这正是把 A03 清单里的fSELECT ... WHERE id{input}这类检测模式变成可量化结果的工程化实现。三、OWASP API Security Top 102023API 专属风险面对于以 REST/GraphQL 接口为主的系统包括 007 技能覆盖的 Webhooks、支付、Bot 生态用这张表替代/补充 Web Top 10 更为精准。它把对象级授权缺失这类 API 高频问题单列出来。#VulnerabilityDescriptionDetection PatternsFixAPI1Broken Object Level Authorization (BOLA)API exposes endpoints that handle object IDs, allowing attackers to access other users objects.GET /api/v1/users/{id}/orderswithout ownership check; sequential/predictable IDs; no authz middleware on data endpoints.Check object ownership in every request. Use random UUIDs, not sequential IDs. Authorization middleware on all data endpoints.API2Broken AuthenticationWeak or missing authentication mechanisms on API endpoints.API keys in URLs; no token expiration; missing auth on internal APIs exposed publicly; credentials in response bodies.OAuth 2.0 / JWT with short expiry. API key rotation. Auth on ALL endpoints. Never expose credentials in responses. Rate limit auth endpoints.API3Broken Object Property Level AuthorizationAPI exposes all object properties, allowing mass assignment or excessive data exposure.Response includespassword_hash,internal_id,is_admin; PUT/PATCH acceptsrolefield from user input.Explicit response schemas (allowlist fields). Block mass assignment. Never auto-expose DB model. Separate read/write DTOs.API4Unrestricted Resource ConsumptionAPI doesnt limit requests, payload sizes, or resource usage, enabling DoS.No pagination (GET /usersreturns all); unlimited file upload size; no rate limiting; expensive queries without timeout.Rate limiting per user/IP. Pagination (max page size). Payload size limits. Query complexity limits. Timeouts on all operations.API5Broken Function Level AuthorizationMissing authorization checks on administrative or privileged API functions.DELETE /api/users/{id}accessible to regular users; admin endpoints without role check; horizontal privilege escalation.RBAC enforcement. Deny by default. Admin endpoints on separate route group with middleware. Regular authorization audits.API6Unrestricted Access to Sensitive Business FlowsAutomated abuse of legitimate business flows (scalping, spam, credential stuffing).Automated account creation; bulk coupon redemption; scraping sensitive listings; no CAPTCHA on sensitive flows.Rate limit business-critical flows. CAPTCHA/device fingerprinting. Anomaly detection. Business logic abuse monitoring.API7Server Side Request Forgery (SSRF)API fetches remote resources without validating user-supplied URLs.POST /api/import {url: http://169.254.169.254/}(AWS metadata); webhook URL to internal services.URL allowlisting. Block internal IP ranges. Disable redirects. Validate URL scheme (https only). Network segmentation.API8Security MisconfigurationMissing security headers, permissive CORS, verbose errors, default credentials on API infrastructure.Access-Control-Allow-Origin: *; detailed error messages with stack traces; default API gateway credentials; TLS 1.0 enabled.Hardened configs. Restrictive CORS. Generic error responses. Security headers. Regular config audits.API9Improper Inventory ManagementDeprecated/unpatched API versions still accessible. Shadow APIs. Undocumented endpoints./api/v1/still active alongside/api/v3/; internal debug endpoints exposed; undocumented admin API; no API gateway.API inventory/catalog. Deprecate and remove old versions. API gateway as single entry point. OpenAPI spec as source of truth.API10Unsafe Consumption of APIsAPI trusts data from third-party APIs without validation, inheriting their vulnerabilities.Blindly trusting webhook payloads; no validation on third-party API responses; following redirects from external APIs.Validate ALL external API responses. Timeout and circuit breakers. Dont trust third-party data more than user input. TLS for all external calls.源码印证API 场景下的两类重点检测API1/API5 的缺失鉴权在 full_audit.py 的 Phase 4/5 中内置了no_auth红队场景模板Unauthorized Access to Unprotected Endpoints与蓝队建议给所有端点加鉴权中间件、实现 RBAC/ABAC、用成熟鉴权库、加限流防爆破当 Phase 6 计算出的鉴权相关评分低于 40 分时该场景会自动补充进报告。API7/SSRFinjection_scanner 的正则覆盖requests.*(、urllib.urlopen、fetch(、axios.*(等携带变量 URL 的调用并在 full_audit.py 中给出与清单一致的修复建议出站 URL 白名单、屏蔽私有 IP 段10.x、172.16-31.x、192.168.x与云元数据端点169.254.169.254、禁用重定向、专用 HTTP 客户端。四、OWASP LLM Top 102025LLM 与 Agent 专属风险面这是三张表中与 007 技能IA/Agentes检查分组、以及与仓库整体2,115 agentic skills、Agent 工作流最相关的一张。LLM 系统引入了传统安全模型未覆盖的威胁类别提示注入、过度授权Excessive Agency、系统提示词泄露、向量库污染等。#VulnerabilityDescriptionDetection PatternsFixLLM01Prompt InjectionAttacker manipulates LLM via crafted input (direct) or poisoned context (indirect).User input contains ignore previous instructions; external documents with hidden instructions; unexpected tool calls after processing user content.Input sanitization. Separate system/user prompts clearly. Output validation. Human-in-the-loop for sensitive actions. Context isolation.LLM02Sensitive Information DisclosureLLM reveals confidential data from training data, system prompts, or context.Model outputs API keys, internal URLs, PII; system prompt extraction via repeat your instructions; context leakage between users.Strip secrets from context. Output filtering for PII/secrets. Session isolation. Dont put secrets in system prompts. Anonymize training data.LLM03Supply Chain VulnerabilitiesCompromised training data, model weights, plugins, or dependencies.Poisoned fine-tuning datasets; malicious third-party plugins; tampered model files; compromised prompt templates.Verify model integrity (checksums). Audit plugins/tools. Signed artifacts. Scan training data. Vendor security assessment.LLM04Data and Model PoisoningAttacker corrupts training/fine-tuning data to influence model behavior.Biased outputs after fine-tuning; backdoor triggers in model responses; degraded performance on specific topics.Data validation pipeline. Anomaly detection on training data. Multiple data sources. Regular model evaluation. Federated learning safeguards.LLM05Improper Output HandlingLLM output passed to downstream systems without sanitization, enabling XSS, injection, RCE.LLM output rendered as HTML without escaping; LLM-generated SQL executed directly; LLM output used in system commands.Treat LLM output as untrusted. Sanitize before rendering. Parameterized queries for LLM-generated SQL. Never pass LLM output toeval()or shell.LLM06Excessive AgencyLLM agent has too many permissions, can perform destructive actions without human approval.Agent can delete files, send emails, modify databases without confirmation; no scope limits on tool access; no approval workflow.Least-privilege tool access. Human-in-the-loop for destructive actions. Read-only by default. Scope limits per session. Action audit logs.LLM07System Prompt LeakageAttacker extracts the system prompt, revealing business logic, guardrails, and instructions.Prompts like what are your instructions?; indirect extraction via role-play; iterative probing to reconstruct system prompt.Dont rely on system prompt secrecy for security. Defense in depth. Monitor for extraction attempts. Separate config from prompts.LLM08Vector and Embedding WeaknessesManipulation of RAG retrieval through poisoned embeddings or adversarial documents.Irrelevant documents surfacing in RAG results; poisoned knowledge base entries; embedding collision attacks.Validate RAG sources. Access control on knowledge base. Embedding anomaly detection. Source attribution in responses. Regular KB audits.LLM09MisinformationLLM generates false/misleading content (hallucinations) presented as fact.Confident assertions about nonexistent APIs; fabricated citations; incorrect code that looks plausible; made-up statistics.Grounding with verified sources (RAG). Confidence scoring. Fact-checking pipeline. Disclaimers on generated content. Human review for critical outputs.LLM10Unbounded ConsumptionExcessive resource usage through crafted prompts, leading to cost explosion or denial of service.Extremely long context inputs; recursive agent loops; prompt that triggers maximum token generation; no budget limits.Token limits per request/session. Budget caps per user. Iteration limits for agents. Timeout on generation. Monitor cost anomalies.源码印证LLM01 提示注入的静态检测injection_scanner.py 为 LLM 场景定义了独立的prompt_injection注入类型检测模式与清单中 LLM01 的检测模式一一对应prompt_injection_fstringprompt f...{user}用户输入直接拼进提示词HIGHprompt_injection_concatprompt user_input/request.body拼接HIGHprompt_injection_openaiopenai/anthropic/llm 调用附近的 f-string 变量插值HIGHprompt_no_sanitize_directmessages 直接 append 用户内容MEDIUM。这与清单给出的修复方向输入清洗、明确分离 system/user prompt、输出校验、敏感操作 human-in-the-loop、上下文隔离相互印证静态扫描负责找到风险位置清单负责给出修复策略。而 LLM06Excessive Agency则对应 007 技能IA/Agentes检查分组中的按 Agent 限制工具集、限制迭代/成本以及 detailed-guide.md 中的绝对原则Bounded Automation / Isolated Agents。五、Quick Audit Checklist快速评审模板清单文件在末尾提供了一张代码评审快速评估模板12 项覆盖三张表的重点可直接作为 PR Review 或交付前自查的勾选单[ ] Authentication on all endpoints (A07/API2) [ ] Authorization checks on every data access (A01/API1/API5) [ ] Input validation and parameterized queries (A03) [ ] No sensitive data in logs or error messages (A09/API8) [ ] Dependencies up to date, no known CVEs (A06) [ ] Rate limiting on all public endpoints (API4) [ ] HTTPS everywhere, TLS 1.2 (A02) [ ] Security headers set (CSP, HSTS, X-Frame-Options) (A05) [ ] LLM output treated as untrusted (LLM05) [ ] Agent tool access follows least privilege (LLM06) [ ] Prompt injection defenses in place (LLM01) [ ] Token/cost budgets configured (LLM10)使用建议把该模板复制进每个 PR 的 review checklist 或发布 gate 中逐项打勾未打勾的项进入缺陷跟踪。注意它不是替代性的深度审计而是一轮快速排出优先级的筛选——命中风险项后应回到上方对应的完整表含 Detection Patterns 与 Fix做深入分析。六、把清单变成自动化007 扫描器落地实践007 技能在清单之外提供了可直接运行的 Python 扫描器仅依赖标准库见 requirements.txt 的说明与 config.py 头部注释把清单中可正则化的检查项变成命令。在仓库内可这样查看与使用# 快速扫描密钥模式 危险代码构造 权限 超大文件输出 0-100 分与结论 python plugins/agentic-awesome-skills-claude/skills/007/scripts/quick_scan.py --target 项目路径 python plugins/agentic-awesome-skills-claude/skills/007/scripts/quick_scan.py --target 项目路径 --output json --verbose # 注入专项扫描覆盖 SQL / 命令 / 代码 / 提示词注入、XSS、SSRF、路径穿越 python plugins/agentic-awesome-skills-claude/skills/007/scripts/scanners/injection_scanner.py --target 项目路径 --output json # 密钥深度扫描在 config 通用模式之上叠加熵分析、base64 检测与 JWT/Stripe/AWS 等专项模式 python plugins/agentic-awesome-skills-claude/skills/007/scripts/scanners/secrets_scanner.py --target 项目路径 # 供应链扫描分析 requirements*.txt / package.json / Dockerfile 的版本锁定与已知风险包 python plugins/agentic-awesome-skills-claude/skills/007/scripts/scanners/dependency_scanner.py --target 项目路径 # 六阶段全量审计测绘 - 威胁建模提示 - 清单 - 红队场景 - 蓝队建议 - 结论 python plugins/agentic-awesome-skills-claude/skills/007/scripts/full_audit.py --target 项目路径 --output markdown值得注意的实现细节均可在仓库源码中验证统一配置中心config.py 集中定义严重度权重SEVERITYCRITICAL5 … INFO1、八个安全域评分权重SCORING_WEIGHTS合计恰为 1.0脚本自带自检断言、结论阈值VERDICT_THRESHOLDS90 通过、70-89 有保留通过、50-69 部分拦截、50 全面拦截、可扫描扩展名与跳过目录.git、node_modules、venv等、资源上限单文件 5MB、单次 10000 文件、单文件 200 条命中、单报告 1000 条命中以及超时文件读取 10s、整次扫描 300s、网络 30s。污点追踪启发式injection_scanner 会先扫一遍全文件标记所有命中用户输入来源正则的行并向前后各 5 行扩展从而能识别变量在第 N 行来自request、在第 N3 行被拼进 SQL这类间接污点命中时会写入has_user_input_nearby字段并在报告中显示[TAINTED]。误报抑制注释行、docstring、Markdown 代码围栏内的命中会被跳过仅硬编码字面量的危险调用降为 INFO测试文件命中整体降一级——这些策略让清单中的检测模式在真实代码库中可落地而不至于被海量误报淹没。可追溯性每次扫描都会调用log_audit_event()向data/audit_log.jsonJSON Lines 格式追加一条审计事件动作、目标、结果、耗时呼应 A09 与Audit Everything原则full_audit 的 Markdown 报告按六阶段结构输出其中 Phase 3 直接呈现PASS / WARN / FAIL形式的清单表。七、在代码评审与威胁建模中的组合用法综合三张清单与 007 的六阶段流程推荐的工作流如下评审入口打开 PR 时先跑quick_scan.py与injection_scanner.py用 Quick Audit Checklist 逐项过一遍命中项记为待办深入定位对每个命中项回到本文对应清单行的 Detection Patterns 确认攻击路径用secrets_scanner.py/dependency_scanner.py专项复核威胁建模闭环在 STRIDE/PASTA 分析中用本文表项作为威胁字典例如 Web 清单中的 A10 SSRF ↔ STRIDE 的 Information DisclosureLLM 清单中的 LLM01 ↔ Spoofing 变体把每条威胁映射到 007 六阶段中的红队场景与蓝队加固建议结论输出用full_audit.py --output markdown生成含评分的正式审计报告对照VERDICT_THRESHOLDS给出通过 / 有保留通过 / 拦截的结论并保留 audit log 供后续趋势分析。最后需要强调的是清单与扫描器都是加速器而非免检证。A04Insecure Design、A09Logging/Monitoring、API6业务流滥用、LLM04模型投毒等设计级问题无法靠正则覆盖必须结合 007 技能的威胁建模、红蓝队推演与人工评审共同完成——这正是 SKILL.md 中安全审计、威胁建模、红蓝队三者并重的设计意图。赞分享AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载相关推荐Agentic Awesome Skills 实战基于 OWASP API Top 10 的系统化 API 安全测试指南Agentic Awesome Skills 实战基于 OWASP API Top 10 的系统化 API 安全测试指南 本篇技术指南以 agentic awAI 技能AI 插件人工智能agent-skills 安全清单详解从威胁建模到 OWASP LLM Top 10 的 Web 应用安全核查路径agent skills 安全清单详解从威胁建模到 OWASP LLM Top 10 的 Web 应用安全核查路径 本篇指南以 agent skills 仓库AI 技能AI 评测AI 插件开发工具Autoresearch 安全审计清单基于 STRIDE 与 OWASP Top 10 的对抗式代码安全审计实战指南Autoresearch 安全审计清单基于 STRIDE 与 OWASP Top 10 的对抗式代码安全审计实战指南 本文是 Autoresearch 项目安AI 技能AI 评测提示工程上一篇CANN LogSoftmax 反向传播算子深度解析aclnnLogSoftmaxBackward 两段式接口从调用到内核实现下一篇CANN Runtime 错误码 EH0008 详解Invalid_Argument_Null_Pointer 空指针参数错误定位与修复创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考