What problem does it solve? Security reviews of web applications often require running separate static scanners and manual penetration tests, then reconciling scattered results. This Skill unifies both phases into one orchestrated audit: it detects nine vulnerability classes (CSRF, XSS, SQLi, file upload, path traversal, broken access control, auth/session, sensitive data exposure, SSRF) from source code, filters false positives with AI context review, and optionally fires real payloads against a staging or local target to confirm exploitability. ## Core Features & Use Cases - Hybrid SAST + DAST orchestration: Runs scan_all.py for static candidate detection (Semgrep with grep fallback), then launches exploiting-* attack scripts against a live target when a URL is provided. - Fail-closed safety gates: scope_guard.py blocks production/public targets at code level, a DB isolation gate prevents polluting shared development databases, and destructive upload tests require explicit opt-in. - Credential hygiene: Passwords and tokens are passed via interactive environment variables (read -rs), never through chat, argv, or files. - Use Case: Before a release, point the Skill at a Spring Boot monorepo and a local staging URL; it auto-detects backend and frontend roots, audits all nine vulnerability classes, confirms IDOR and JWT issues with cross-account tests, and writes a severity-ranked four-element report (what, why, how, fix) to reports/. ## Quick Start Ask the AI to run a full security audit on your project source path with an optional local staging URL, for example: audit D:\SQ\my-project against http://localhost:8080 and produce a consolidated vulnerability report.
