sec-audit-cn在中国等地区进行代码安全审计、安全编码与评审时使用：覆盖 OWASP Top 10、鉴权与授权、密钥与配置、CORS/CSP、 输入校验与防注入、XSS/CSRF、依赖漏洞、日志与错误处理；输出分级结论与可执行修复建议。 适用于 Web/API、移动端后端、小程序服务端、涉及个人信息与支付回调的业务。
Install via ClawdBot CLI:
clawdbot install clawkk/sec-audit-cnGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
process.env.API_KEYPotentially destructive shell commands in tool definitions
curl | bashCalls external URL not in known-safe list
https://api.example.comAI Analysis
The skill definition is a legitimate security audit guide focused on code review and best practices. The rule-based signals (like accessing process.env.API_KEY) appear to be examples within educational code snippets, not actual credential harvesting. The external URL mentioned is likely a placeholder example, not evidence of data exfiltration.
Generated May 19, 2026
对电商平台的Web端、移动端后端及支付回调进行安全审计，覆盖OWASP Top 10风险，重点检查用户鉴权、支付接口的防重放与签名校验、个人信息保护（如手机号、地址脱敏）及依赖漏洞。输出分级修复建议。
针对金融科技系统的安全编码与架构评审，包括身份认证（JWT/OAuth）、交易授权、密钥管理（如加密密钥轮换）、CORS/CSP配置，以及防止SQL注入和XSS攻击。符合等保2.0要求。
对微信小程序或支付宝小程序的后端服务进行安全审计，检查小程序登录、会话管理、开放平台回调验证、用户数据加密传输与存储，以及防止CSRF和SSRF攻击。输出可执行修复方案。
为医疗健康应用的开发团队提供安全编码指引，重点审查患者数据的加密存储与传输、接口鉴权、输入校验防止注入、日志脱敏（不包含完整病历），以及第三方SDK的供应链安全。
提供基于云的安全审计平台，用户上传代码或配置后自动生成OWASP Top 10审计报告及修复建议。按月或按次收费，适合中小企业。
为企业提供安全编码培训、架构评审及渗透测试服务，输出合规报告（如等保）。按项目或人天收费，适合金融机构或监管严格行业。
将安全审计规则集成到CI/CD流水线，提供插件（如VS Code、IDE），帮助开发者在编码阶段发现漏洞。工具免费或开源，增值服务（如高级报告、合规支持）订阅制。
💬 Integration Tip
将安全审计规则集成到CI/CD流水线中，使用自动化SCA和SAST工具，并在代码审查阶段结合人工评审，以提高发现效率和覆盖深度。
Scored May 19, 2026
Audited Apr 16, 2026 · audit v1.0
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Security scanner for AI agent skills. 9 built-in detection signatures. Identifies secrets, unsafe execution patterns, and prompt injection. Sub-50ms results.
Wallet anti-theft guard. One-click scan for high-risk wallet approvals to protect user assets. Use when a user asks for a wallet security check, wallet healt...
Comprehensive security audit for an agent's full skill stack. Chains scanner, differ, trust-verifier, and health-monitor into a single assessment with priori...
GEO Audit — AI Search Visibility Checker for ChatGPT, Perplexity, Claude & Gemini. 29-point GEO readiness checklist: robots.txt AI crawler access, Index...
Audit and analyze Solidity smart contracts for security vulnerabilities. Use when reviewing, auditing, or analyzing smart contracts, Solidity code, DeFi prot...