kernel-audit-security

Files (200)

• plugin.json · .claude-plugin/
• LICENSE-NOTES.md
• SKILL.md
• api-security-reviewer.md · agents/
• code-security-reviewer.md · agents/
• dependency-auditor.md · agents/
• mobile-security-reviewer.md · agents/
• security-team-lead.md · agents/
• AI-AND-LLM.md · audit-methodology/
• ATTACK-CLASSES.md · audit-methodology/
• CLIENT-SIDE.md · audit-methodology/
• HUNTING.md · audit-methodology/
• MEMORY-SAFETY-AND-BINARY.md · audit-methodology/
• RECONNAISSANCE.md · audit-methodology/
• SKILL.md · audit-methodology/
• VALIDATION-AND-REPORTING.md · audit-methodology/
• WEB-PROTOCOL-AND-AUTH.md · audit-methodology/
• report-schema.json · audit-methodology/
• validate-findings.cjs · audit-methodology/
• README.md · data/asvs/
• V1.1.md · data/asvs/
• V1.2.md · data/asvs/
• V1.3.md · data/asvs/
• V1.4.md · data/asvs/
• V1.5.md · data/asvs/
• V10.1.md · data/asvs/
• V10.2.md · data/asvs/
• V10.3.md · data/asvs/
• V10.4.md · data/asvs/
• V10.5.md · data/asvs/
• V10.6.md · data/asvs/
• V10.7.md · data/asvs/
• V11.1.md · data/asvs/
• V11.2.md · data/asvs/
• V11.3.md · data/asvs/
• V11.4.md · data/asvs/
• V11.5.md · data/asvs/
• V11.6.md · data/asvs/
• V11.7.md · data/asvs/
• V12.1.md · data/asvs/
• V12.2.md · data/asvs/
• V12.3.md · data/asvs/
• V13.1.md · data/asvs/
• V13.2.md · data/asvs/
• V13.3.md · data/asvs/
• V13.4.md · data/asvs/
• V14.1.md · data/asvs/
• V14.2.md · data/asvs/
• V14.3.md · data/asvs/
• V15.1.md · data/asvs/
• V15.2.md · data/asvs/
• V15.3.md · data/asvs/
• V15.4.md · data/asvs/
• V16.1.md · data/asvs/
• V16.2.md · data/asvs/
• V16.3.md · data/asvs/
• V16.4.md · data/asvs/
• V16.5.md · data/asvs/
• V17.1.md · data/asvs/
• V17.2.md · data/asvs/
• …and 140 more

SKILL.md (first lines)

> **Licensing.** The router and mode structure are MIT. `reviews/`, `plays/`, `agents/` and
> `templates/` are vendored from the OWASP secure-agent-playbook (CC-BY-4.0, Chris Maenner);
> `audit-methodology/` from cloudflare/security-audit-skill (MIT); `data/asvs`, `data/masvs` and
> `data/mastg` are OWASP datasets (CC-BY-SA). Sources and pinned commits: `LICENSE-NOTES.md`.

## When to use

- user asks to find security bugs, do a security review, or audit code for vulnerabilities
- user asks for a pen-test or an exploit-evidence security audit of a codebase
- user is reviewing API, web, mobile, or infrastructure-as-code surfaces for security risk
- user wants secrets, dependency, or supply-chain security checked before merge or deploy
- user wants OWASP Top 10, ASVS, or MASVS coverage applied to a feature or repo

## Outputs

- Prioritized findings report with evidence, attack scenario, impact, confidence, remediation
- Mode-appropriate artifact: review findings or full audit package (REPORT.md, FINDINGS-DETAIL.md, findings.json)

## Definition of done

- Every finding cites file and line evidence plus a concrete attack scenario
- Findings carry severity justified by likelihood and impact, not checklist deviation
- Review mode names the play followed; audit mode produces REPORT.md and findings.json

Security work in two modes. Pick by request intent; if ambiguous, ask one question.

## Evidence bar (both modes)

Every finding must include file and line evidence, a concrete attack scenario ("send this request, get this result" — not "an attacker could theoretically"), impact, confidence, and remediation. Defense-in-depth gaps are hardening notes, not findings. Severity requires demonstrated likelihood and impact. Do not pad reports with LOW findings; say what the codebase does well.

## Mode 1: Review (scoped, checklist-grounded)

Use the vendored specialist skills under `reviews/` with their procedures under `plays/`:

- `reviews/api-security-review/SKILL.md` — REST/GraphQL/gRPC, auth mechanisms, gateways (Hominem: `services/api`)
- `reviews/code-review-security/SKILL.md` — shared packages and web code
- `reviews/web-security-review/SKILL.md` — classic OWASP Top 10 web review
- `reviews/mobile-code-review/SKILL.md` — native Android/iOS source (MASVS)
- `reviews/iac-security-review/SKILL.md` — Terraform, Kubernetes, CloudFormation
- `reviews/sca-audit/SKILL.md` — CVEs, unmaintained packages, lockfiles (pnpm workspace)
- `reviews/secrets-scan/SKILL.md` — source and Git history credential exposure
- `reviews/security-guidance/SKILL.md` — ASVS-grounded guidance while writing new code
- `reviews/prd-securability-enhancement/SKILL.md` — embed ASVS/FIASSE coverage in PRDs and specs
- `reviews/securability-engineering/SKILL.md` — generate hardened, securable code
- `reviews/securability-engineering-review/SKILL.md` — SSEM scorecard for existing code

Route adjacent domains elsewhere: third-party frontend assets and external integrations to `kernel-audit-integration-security`.

## Mode 2: Offensive audit (exploit-evidence bar)

For "find exploitable bugs", pen-test requests, or full-codebase audits, run the six-phase methodology in [audit-methodology/SKILL.md](audit-methodology/SKILL.md):

1. Recon — map architecture, trust boundaries, input surfaces ([audit-methodology/RECONNAISSANCE.md](audit-methodology/RECONNAISSANCE.md))
2. Hunt — parallel hunting with validation rules ([audit-methodology/HUNTING.md](audit-methodology/HUNTING.md)), scopes from [audit-methodology/ATTACK-CLASSES.md](audit-methodology/ATTACK-CLASSES.md)
3. Validate — adversarially disprove every finding
4. Report — REPORT.md + FINDINGS-DETAIL.md ([audit-methodology/VALIDATION-AND-REPORTING.md](audit-methodology/VALIDATION-AND-REPORTING.md))
5. Structured output — findings.json validated against the schema
6. Independent verification — reconcile all outputs

Domain companions: memory safety/binary targets, AI/LLM targets, HTTP protocol/auth, client-side. Templates live in `templates/`; reviewer role prompts in `agents/`; ASVS/MASVS/MASTG/FIASSE datasets in `data/`.

See [LICENSE-NOTES.md](LICENSE-NOTES.md) for provenance and licensing.

From ponti-studios/kernel, MIT.

More from ponti-studios/kernel