[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-efbaef56-0dd9-4183-8030-2aaf8de9b955":3,"$fD7tPy4vOLfDELbpXr5ZBit4F2vg52q6AEDFnCwTOoFE":43},{"id":4,"title":5,"description":6,"categoryId":7,"moduleId":8,"tags":9,"prompt":10,"icon":11,"source":12,"sourceUrl":13,"authorId":14,"authorName":15,"isPublic":16,"stars":17,"runs":18,"createdAt":19,"updatedAt":19,"module":20,"category":27,"packages":34},"efbaef56-0dd9-4183-8030-2aaf8de9b955","security-scanning-security-sast","静态应用安全测试（SAST）代码漏洞","cat_life_career","mod_other","sickn33,other","---\nname: security-scanning-security-sast\ndescription: 'Static Application Security Testing (SAST) for code vulnerability\n\n  analysis across multiple languages and frameworks\n\n  '\nrisk: unknown\nsource: community\ndate_added: '2026-02-27'\n---\n# SAST Security Plugin\n\nStatic Application Security Testing (SAST) for comprehensive code vulnerability detection across multiple languages, frameworks, and security patterns.\n\n## Capabilities\n\n- **Multi-language SAST**: Python, JavaScript\u002FTypeScript, Java, Ruby, PHP, Go, Rust\n- **Tool integration**: Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, cargo-clippy\n- **Vulnerability patterns**: SQL injection, XSS, hardcoded secrets, path traversal, IDOR, CSRF, insecure deserialization\n- **Framework analysis**: Django, Flask, React, Express, Spring Boot, Rails, Laravel\n- **Custom rule authoring**: Semgrep pattern development for organization-specific security policies\n\n## Use this skill when\n\nUse for code review security analysis, injection vulnerabilities, hardcoded secrets, framework-specific patterns, custom security policy enforcement, pre-deployment validation, legacy code assessment, and compliance (OWASP, PCI-DSS, SOC2).\n\n**Specialized tools**: Use `security-secrets.md` for advanced credential scanning, `security-owasp.md` for Top 10 mapping, `security-api.md` for REST\u002FGraphQL endpoints.\n\n## Do not use this skill when\n\n- You only need runtime testing or penetration testing\n- You cannot access the source code or build outputs\n- The environment forbids third-party scanning tools\n\n## Instructions\n\n1. Identify the languages, frameworks, and scope to scan.\n2. Select SAST tools and configure rules for the codebase.\n3. Run scans in CI or locally with reproducible settings.\n4. Triage findings, prioritize by severity, and propose fixes.\n\n## Safety\n\n- Avoid uploading proprietary code to external services without approval.\n- Require review before enabling auto-fix or blocking releases.\n\n## SAST Tool Selection\n\n### Python: Bandit\n\n```bash\n# Installation & scan\npip install bandit\nbandit -r . -f json -o bandit-report.json\nbandit -r . -ll -ii -f json  # High\u002FCritical only\n```\n\n**Configuration**: `.bandit`\n```yaml\nexclude_dirs: ['\u002Ftests\u002F', '\u002Fvenv\u002F', '\u002F.tox\u002F', '\u002Fbuild\u002F']\ntests: [B201, B301, B302, B303, B304, B305, B307, B308, B312, B323, B324, B501, B502, B506, B602, B608]\nskips: [B101]\n```\n\n### JavaScript\u002FTypeScript: ESLint Security\n\n```bash\nnpm install --save-dev eslint @eslint\u002Fplugin-security eslint-plugin-no-secrets\neslint . --ext .js,.jsx,.ts,.tsx --format json > eslint-security.json\n```\n\n**Configuration**: `.eslintrc-security.json`\n```json\n{\n  \"plugins\": [\"@eslint\u002Fplugin-security\", \"eslint-plugin-no-secrets\"],\n  \"extends\": [\"plugin:security\u002Frecommended\"],\n  \"rules\": {\n    \"security\u002Fdetect-object-injection\": \"error\",\n    \"security\u002Fdetect-non-literal-fs-filename\": \"error\",\n    \"security\u002Fdetect-eval-with-expression\": \"error\",\n    \"security\u002Fdetect-pseudo-random-prng\": \"error\",\n    \"no-secrets\u002Fno-secrets\": \"error\"\n  }\n}\n```\n\n### Multi-Language: Semgrep\n\n```bash\npip install semgrep\nsemgrep --config=auto --json --output=semgrep-report.json\nsemgrep --config=p\u002Fsecurity-audit --json\nsemgrep --config=p\u002Fowasp-top-ten --json\nsemgrep ci --config=auto  # CI mode\n```\n\n**Custom Rules**: `.semgrep.yml`\n```yaml\nrules:\n  - id: sql-injection-format-string\n    pattern: cursor.execute(\"... %s ...\" % $VAR)\n    message: SQL injection via string formatting\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-89\"\n      owasp: \"A03:2021-Injection\"\n\n  - id: dangerous-innerHTML\n    pattern: $ELEM.innerHTML = $VAR\n    message: XSS via innerHTML assignment\n    severity: ERROR\n    languages: [javascript, typescript]\n    metadata:\n      cwe: \"CWE-79\"\n\n  - id: hardcoded-aws-credentials\n    patterns:\n      - pattern: $KEY = \"AKIA...\"\n      - metavariable-regex:\n          metavariable: $KEY\n          regex: \"(aws_access_key_id|AWS_ACCESS_KEY_ID)\"\n    message: Hardcoded AWS credentials detected\n    severity: ERROR\n    languages: [python, javascript, java]\n\n  - id: path-traversal-open\n    patterns:\n      - pattern: open($PATH, ...)\n      - pattern-not: open(os.path.join(SAFE_DIR, ...), ...)\n      - metavariable-pattern:\n          metavariable: $PATH\n          patterns:\n            - pattern: $REQ.get(...)\n    message: Path traversal via user input\n    severity: ERROR\n    languages: [python]\n\n  - id: command-injection\n    patterns:\n      - pattern-either:\n          - pattern: os.system($CMD)\n          - pattern: subprocess.call($CMD, shell=True)\n      - metavariable-pattern:\n          metavariable: $CMD\n          patterns:\n            - pattern-either:\n                - pattern: $X + $Y\n                - pattern: f\"...{$VAR}...\"\n    message: Command injection via shell=True\n    severity: ERROR\n    languages: [python]\n```\n\n### Other Language Tools\n\n**Java**: `mvn spotbugs:check`\n**Ruby**: `brakeman -o report.json -f json`\n**Go**: `gosec -fmt=json -out=gosec.json .\u002F...`\n**Rust**: `cargo clippy -- -W clippy::unwrap_used`\n\n## Vulnerability Patterns\n\n### SQL Injection\n\n**VULNERABLE**: String formatting\u002Fconcatenation with user input in SQL queries\n\n**SECURE**:\n```python\n# Parameterized queries\ncursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\nUser.objects.filter(id=user_id)  # ORM\n```\n\n### Cross-Site Scripting (XSS)\n\n**VULNERABLE**: Direct HTML manipulation with unsanitized user input (innerHTML, outerHTML, document.write)\n\n**SECURE**:\n```javascript\n\u002F\u002F Use textContent for plain text\nelement.textContent = userInput;\n\n\u002F\u002F React auto-escapes\n\u003Cdiv>{userInput}\u003C\u002Fdiv>\n\n\u002F\u002F Sanitize when HTML required\nimport DOMPurify from 'dompurify';\nelement.innerHTML = DOMPurify.sanitize(userInput);\n```\n\n### Hardcoded Secrets\n\n**VULNERABLE**: Hardcoded API keys, passwords, tokens in source code\n\n**SECURE**:\n```python\nimport os\nAPI_KEY = os.environ.get('API_KEY')\nPASSWORD = os.getenv('DB_PASSWORD')\n```\n\n### Path Traversal\n\n**VULNERABLE**: Opening files using unsanitized user input\n\n**SECURE**:\n```python\nimport os\nALLOWED_DIR = '\u002Fvar\u002Fwww\u002Fuploads'\nfile_name = request.args.get('file')\nfile_path = os.path.join(ALLOWED_DIR, file_name)\nfile_path = os.path.realpath(file_path)\nif not file_path.startswith(os.path.realpath(ALLOWED_DIR)):\n    raise ValueError(\"Invalid file path\")\nwith open(file_path, 'r') as f:\n    content = f.read()\n```\n\n### Insecure Deserialization\n\n**VULNERABLE**: pickle.loads(), yaml.load() with untrusted data\n\n**SECURE**:\n```python\nimport json\ndata = json.loads(user_input)  # SECURE\nimport yaml\nconfig = yaml.safe_load(user_input)  # SECURE\n```\n\n### Command Injection\n\n**VULNERABLE**: os.system() or subprocess with shell=True and user input\n\n**SECURE**:\n```python\nsubprocess.run(['ping', '-c', '4', user_input])  # Array args\nimport shlex\nsafe_input = shlex.quote(user_input)  # Input validation\n```\n\n### Insecure Random\n\n**VULNERABLE**: random module for security-critical operations\n\n**SECURE**:\n```python\nimport secrets\ntoken = secrets.token_hex(16)\nsession_id = secrets.token_urlsafe(32)\n```\n\n## Framework Security\n\n### Django\n\n**VULNERABLE**: @csrf_exempt, DEBUG=True, weak SECRET_KEY, missing security middleware\n\n**SECURE**:\n```python\n# settings.py\nDEBUG = False\nSECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')\n\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n    'django.middleware.csrf.CsrfViewMiddleware',\n    'django.middleware.clickjacking.XFrameOptionsMiddleware',\n]\n\nSECURE_SSL_REDIRECT = True\nSESSION_COOKIE_SECURE = True\nCSRF_COOKIE_SECURE = True\nX_FRAME_OPTIONS = 'DENY'\n```\n\n### Flask\n\n**VULNERABLE**: debug=True, weak secret_key, CORS wildcard\n\n**SECURE**:\n```python\nimport os\nfrom flask_talisman import Talisman\n\napp.secret_key = os.environ.get('FLASK_SECRET_KEY')\nTalisman(app, force_https=True)\nCORS(app, origins=['https:\u002F\u002Fexample.com'])\n```\n\n### Express.js\n\n**VULNERABLE**: Missing helmet, CORS wildcard, no rate limiting\n\n**SECURE**:\n```javascript\nconst helmet = require('helmet');\nconst rateLimit = require('express-rate-limit');\n\napp.use(helmet());\napp.use(cors({ origin: 'https:\u002F\u002Fexample.com' }));\napp.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));\n```\n\n## Multi-Language Scanner Implementation\n\n```python\nimport json\nimport subprocess\nfrom pathlib import Path\nfrom typing import Dict, List, Any\nfrom dataclasses import dataclass\nfrom datetime import datetime\n\n@dataclass\nclass SASTFinding:\n    tool: str\n    severity: str\n    category: str\n    title: str\n    description: str\n    file_path: str\n    line_number: int\n    cwe: str\n    owasp: str\n    confidence: str\n\nclass MultiLanguageSASTScanner:\n    def __init__(self, project_path: str):\n        self.project_path = Path(project_path)\n        self.findings: List[SASTFinding] = []\n\n    def detect_languages(self) -> List[str]:\n        \"\"\"Auto-detect languages\"\"\"\n        languages = []\n        indicators = {\n            'python': ['*.py', 'requirements.txt'],\n            'javascript': ['*.js', 'package.json'],\n            'typescript': ['*.ts', 'tsconfig.json'],\n            'java': ['*.java', 'pom.xml'],\n            'ruby': ['*.rb', 'Gemfile'],\n            'go': ['*.go', 'go.mod'],\n            'rust': ['*.rs', 'Cargo.toml'],\n        }\n        for lang, patterns in indicators.items():\n            for pattern in patterns:\n                if list(self.project_path.glob(f'**\u002F{pattern}')):\n                    languages.append(lang)\n                    break\n        return languages\n\n    def run_comprehensive_sast(self) -> Dict[str, Any]:\n        \"\"\"Execute all applicable SAST tools\"\"\"\n        languages = self.detect_languages()\n\n        scan_results = {\n            'timestamp': datetime.now().isoformat(),\n            'languages': languages,\n            'tools_executed': [],\n            'findings': []\n        }\n\n        self.run_semgrep_scan()\n        scan_results['tools_executed'].append('semgrep')\n\n        if 'python' in languages:\n            self.run_bandit_scan()\n            scan_results['tools_executed'].append('bandit')\n        if 'javascript' in languages or 'typescript' in languages:\n            self.run_eslint_security_scan()\n            scan_results['tools_executed'].append('eslint-security')\n\n        scan_results['findings'] = [vars(f) for f in self.findings]\n        scan_results['summary'] = self.generate_summary()\n        return scan_results\n\n    def run_semgrep_scan(self):\n        \"\"\"Run Semgrep\"\"\"\n        for ruleset in ['auto', 'p\u002Fsecurity-audit', 'p\u002Fowasp-top-ten']:\n            try:\n                result = subprocess.run([\n                    'semgrep', '--config', ruleset, '--json', '--quiet',\n                    str(self.project_path)\n                ], capture_output=True, text=True, timeout=300)\n\n                if result.stdout:\n                    data = json.loads(result.stdout)\n                    for f in data.get('results', []):\n                        self.findings.append(SASTFinding(\n                            tool='semgrep',\n                            severity=f.get('extra', {}).get('severity', 'MEDIUM').upper(),\n                            category='sast',\n                            title=f.get('check_id', ''),\n                            description=f.get('extra', {}).get('message', ''),\n                            file_path=f.get('path', ''),\n                            line_number=f.get('start', {}).get('line', 0),\n                            cwe=f.get('extra', {}).get('metadata', {}).get('cwe', ''),\n                            owasp=f.get('extra', {}).get('metadata', {}).get('owasp', ''),\n                            confidence=f.get('extra', {}).get('metadata', {}).get('confidence', 'MEDIUM')\n                        ))\n            except Exception as e:\n                print(f\"Semgrep {ruleset} failed: {e}\")\n\n    def generate_summary(self) -> Dict[str, Any]:\n        \"\"\"Generate statistics\"\"\"\n        severity_counts = {'CRITICAL': 0, 'HIGH': 0, 'MEDIUM': 0, 'LOW': 0}\n        for f in self.findings:\n            severity_counts[f.severity] = severity_counts.get(f.severity, 0) + 1\n\n        return {\n            'total_findings': len(self.findings),\n            'severity_breakdown': severity_counts,\n            'risk_score': self.calculate_risk_score(severity_counts)\n        }\n\n    def calculate_risk_score(self, severity_counts: Dict[str, int]) -> int:\n        \"\"\"Risk score 0-100\"\"\"\n        weights = {'CRITICAL': 10, 'HIGH': 7, 'MEDIUM': 4, 'LOW': 1}\n        total = sum(weights[s] * c for s, c in severity_counts.items())\n        return min(100, int((total \u002F 50) * 100))\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: SAST Scan\non:\n  pull_request:\n    branches: [main]\n\njobs:\n  sast:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v3\n      - uses: actions\u002Fsetup-python@v4\n        with:\n          python-version: '3.11'\n\n      - name: Install tools\n        run: |\n          pip install bandit semgrep\n          npm install -g eslint @eslint\u002Fplugin-security\n\n      - name: Run scans\n        run: |\n          bandit -r . -f json -o bandit.json || true\n          semgrep --config=auto --json --output=semgrep.json || true\n\n      - name: Upload reports\n        uses: actions\u002Fupload-artifact@v3\n        with:\n          name: sast-reports\n          path: |\n            bandit.json\n            semgrep.json\n```\n\n### GitLab CI\n\n```yaml\nsast:\n  stage: test\n  image: python:3.11\n  script:\n    - pip install bandit semgrep\n    - bandit -r . -f json -o bandit.json || true\n    - semgrep --config=auto --json --output=semgrep.json || true\n  artifacts:\n    reports:\n      sast: bandit.json\n```\n\n## Best Practices\n\n1. **Run early and often** - Pre-commit hooks and CI\u002FCD\n2. **Combine multiple tools** - Different tools catch different vulnerabilities\n3. **Tune false positives** - Configure exclusions and thresholds\n4. **Prioritize findings** - Focus on CRITICAL\u002FHIGH first\n5. **Framework-aware scanning** - Use specific rulesets\n6. **Custom rules** - Organization-specific patterns\n7. **Developer training** - Secure coding practices\n8. **Incremental remediation** - Fix gradually\n9. **Baseline management** - Track known issues\n10. **Regular updates** - Keep tools current\n\n## Related Tools\n\n- **security-secrets.md** - Advanced credential detection\n- **security-owasp.md** - OWASP Top 10 assessment\n- **security-api.md** - API security testing\n- **security-scan.md** - Comprehensive security scanning\n\n## Limitations\n- Use this skill only when the task clearly matches the scope described above.\n- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.\n- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.\n","","imported","https:\u002F\u002Fgithub.com\u002Fsickn33\u002Fantigravity-awesome-skills","user_system_seed","SkillOPIC",true,160,1647,"2026-05-16 13:38:31",{"id":8,"name":21,"slug":22,"icon":23,"description":24,"sort":25,"createdAt":26},"其他","other","mdi-page-next-outline","其他类型Skill",5,"2026-05-16 12:53:40",{"id":7,"name":28,"slug":29,"icon":30,"description":31,"moduleId":8,"sort":32,"skillCount":33,"createdAt":26},"职场发展","career","mdi-briefcase-outline","面试准备、简历优化、职业规划",4,575,[35],{"id":36,"skillId":4,"version":37,"fileName":38,"fileSize":39,"filePath":40,"fileHash":41,"manifest":42,"createdAt":19},"2931bdb1-1a31-4bad-99e0-2c000caffb23","1.0.0","security-scanning-security-sast.zip",5602,"uploads\u002Fskills\u002Fefbaef56-0dd9-4183-8030-2aaf8de9b955\u002Fsecurity-scanning-security-sast.zip","983c317d3d47031ccbf646ad2154013b10fe5161a4b12527cdc8ce909666ec29","[{\"path\":\"SKILL.md\",\"isDirectory\":false,\"size\":14715}]",{"code":44,"message":45,"data":46},200,"success",{"items":47,"stats":48,"page":51},[],{"averageRating":49,"totalRatings":49,"ratingCounts":50},0,[49,49,49,49,49],{"limit":52,"offset":49,"hasMore":53,"nextOffset":52,"ratedOnly":16},15,false]