audit-scope

仓库创建 2025年2月1日最近提交 7 天前SkillHot 收录 1 天前

▸ 精选理由

快速产出使命/攻击者故事和估时表，便于接单与定价

▸ 风险提示

会访问指定 GitHub 仓库及 API，需要授予读取权限并注意敏感代码暴露

这个 Skill 做什么

根据仓库或 API 描述生成安全审计范围与工日估算

根据 GitHub 仓库或 API 描述生成安全审计的范围文档，给出三行式的 mission/user/attacker 描述并列出按 NSLOC 划分的关注点与工日估算。用在需要快速确定审计边界、工作量和报价的时候。特点是把范围量化为天数和重点模块，方便计划与沟通。

▸ 展开 SKILL.md 英文原文

Generate a security audit scope document from one or more GitHub repo URLs and/or API access descriptions. Outputs a 3-line protocol narrative (mission, user story, attacker story) followed by a scope table with NSLOC, focus areas, and days. Use when scoping a new audit engagement.

开发编程审计范围安全评估GitHub分析通用

120

Stars

Forks

仓库内 Skill

+11

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/forefy/.context/main/skills/audit-scope/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/forefy/.context/main/skills/audit-scope/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Audit Scope Skill

## Inputs

User provides one or more of:
- GitHub repo URL(s)
- API documentation / access description (no repo)
- Named scope components (e.g. "also include the webhook service")

No report-days input needed - report writing is hardcoded (see Constants).

## Constants (hardcoded, never ask user)

- **Report writing**: always 1 day

Scope is measured in days. Do not attach monetary amounts to the output - days are the unit of measurement here.

## Step-by-step execution

### 1. Ingest repos

For each GitHub repo URL provided:
- Clone to `/tmp/<repo-name>-audit` via `gh repo clone`
- Run `cloc <repo> --quiet --not-match-f="(?i)(spec|test)" --not-match-d="(test|spec|__test

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有