Security · PHP · For developers

Professional code security audit skill covering 55+ vulnerability types.

3stoneBrother/code-audit

当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用。仅用于授权代码审计和防御性安全验证。

RuoJi6/audit-skills

Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter).

symfony/symfony

Review a change (a PR, the current branch diff, or a set of files) or audit a component or the whole tree for missing or incorrect security hardening.

symfony/symfony

Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.

duriantaco/skylos

Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.

duriantaco/skylos

Reviews WordPress plugin, theme and block code after an agent writes or edits it, catching missing escaping, nonces, capability checks and unprepared queries.

amElnagdy/guard-skills

PHP Web 全链路白盒代码安全审计流水线（多文件版编排）。作为总编排参考，按 Sink 类型调用各子审计 skill（php-route-mapper/php-auth-audit/php-route-tracer/php--audit），并复用统一输出与分级标准。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。

0xShe/PHP-Code-Audit-Skill

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells.

Eyadkelleh/awesome-skills-security

CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。

0xShe/PHP-Code-Audit-Skill

Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or…

PentesterFlow/agent

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent.

MuWinds/BUUCTF_Agent

Insecure deserialization detection and gadget chain exploitation

NeoTheCapt/RedteamAgent

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

sickn33/agentic-awesome-skills

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

github/awesome-copilot

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks.

langbyyi/CyberStrikeAI-SRC

Complete WordPress development workflow covering theme development, plugin creation, WooCommerce integration, performance optimization, and security hardening.

sickn33/agentic-awesome-skills

Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 SSRF 审计工具。识别用户可控 URL/地址进入网络请求 Sink，追踪内网/协议/端口限制与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

Symfony 框架特效安全审计工具。针对 Symfony 常见 security.yaml、CSRF、Twig/Twig raw、表达式与访问控制等框架机制做白盒静态审计，并将风险映射到通用漏洞类型体系（AUTH/CSRF/CFG/XSS/TPL/LOGIC 等）。

0xShe/PHP-Code-Audit-Skill

ThinkPHP 框架特效安全审计工具。针对 ThinkPHP 常见的鉴权/CSRF/模板转义/ORM 写入（Mass Assignment）/调试与配置暴露等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/TPL/XSS/LOGIC/CFG/SESS/SQL 等）。

0xShe/PHP-Code-Audit-Skill

WordPress 框架特效安全审计工具。针对 WordPress 常见 nonce/capability/checkadminreferer、AJAX action、escape/sanitize、重定向、安全上传与远程请求等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/SQL/CFG/SSRF 等）。

0xShe/PHP-Code-Audit-Skill

Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。

0xShe/PHP-Code-Audit-Skill

Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP Web 源码 XSS 审计工具。识别用户输入进入输出上下文（HTML/属性/JS/URL/模板），分析转义与防护策略，输出可利用性分级、PoC 与修复建议（禁止省略）。

0xShe/PHP-Code-Audit-Skill

PHP type juggling and weak comparison (==) bypass. An agent skill from langbyyi/CyberStrikeAI-SRC.

langbyyi/CyberStrikeAI-SRC

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces.

langbyyi/CyberStrikeAI-SRC

Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution

NeoTheCapt/RedteamAgent

Mass scan for exposed env files, backups, and git configs. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

WordPress plugin development with hooks, security, REST API, custom post types.

secondsky/claude-skills

Hunt Insecure Deserialization

sickn33/agentic-awesome-skills

Hunt file upload bugs

sickn33/agentic-awesome-skills

Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.

Encod3d-Sec/TORCH

WordPress security code review and vulnerability detection. An agent skill from jorgerosal/wordpress-skills.

jorgerosal/wordpress-skills

Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash…

trilwu/secskills

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec/AboutSecurity

PHP-only security standards for database access, password handling, and input validation.

HoangNguyen0403/agent-skills-standard

Webshell samples for detection and analysis webshell 样本: PHP, ASP, ASPX, JSP, Python, Perl shells.

Ch1nfo/RiftX

Static ReDoS (Regular Expression Denial of Service) vulnerability scanner and regex quality auditor for codebases.

LeoYeAI/openclaw-master-skills

CTF/靶场 Flag 强制验证流程。当通过任何方式发现疑似 flag 字符串（含 flag{、FLAG{、ctf{ 等格式）时必须立即使用此 skill 验证，不要直接提交。防止因字符截断、编码错误、HTML 实体、base64 不完整解码、hex 截断等原因导致提交错误 flag。即使 flag 看起来完整，也可能存在隐藏字符或编码问题。覆盖 SQL…

wgpsec/AboutSecurity

CTF Web 挑战专用侦察方法。当面对 CTF 靶场目标需要快速发现攻击入口时使用。与真实渗透的 recon 不同——CTF 是单个应用、有意留线索、侦察应在 2-3 轮内完成。覆盖源码泄露、备份文件、隐藏路径、页面线索提取

wgpsec/AboutSecurity

当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。

zhaji2333/CkSKILLS

Configure PHP ecosystem tooling, dependency management, and static analysis.

HoangNguyen0403/agent-skills-standard

PHP 源码认证、配置与逻辑类漏洞审计。当在 PHP 白盒审计中需要检测认证绕过、 权限控制、安全配置、密码学误用或业务逻辑漏洞时触发。

wgpsec/AboutSecurity

PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、 需要检查框架特有安全机制和常见配置缺陷时触发。

wgpsec/AboutSecurity

PHP 源码前端交互类漏洞审计。当在 PHP 白盒审计中需要检测前端安全相关漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity