skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

java-audit

Audits Java projects for vulnerable dependencies, hardcoded secrets, and framework misconfigurations.

632|86|Updated Apr 29, 2023
Search Tags:#static analysis#code review#security audit#java#spring boot#sca#hardcoded secrets
One-click install
npx skills add https://github.com/yaklang/yaklang --skill java-audit-yaklang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: java-audit
Source: https://github.com/yaklang/yaklang/tree/main/common/ai/aid/aireact/skills/java-audit
Command: npx skills add https://github.com/yaklang/yaklang --skill java-audit-yaklang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually reviewing large Java codebases for security issues is slow and error-prone, especially in monorepos with multiple frameworks and CMS products. This Skill runs deterministic static audits that surface vulnerable dependencies, hardcoded credentials, and insecure framework configurations with file/line evidence. ## Core Features & Use Cases - Project Probing: Detects build systems (Maven/Gradle), frameworks (Spring Boot, Shiro, Struts2, and 9 more), and CMS products (RuoYi, MCMS, Halo), then recommends the right audit tools. - Dependency SCA & Secrets Scanning: Extracts Maven/Gradle/JAR dependencies to flag risky components and scans for hardcoded passwords, API keys, JDBC credentials, JWTs, and private keys. - Framework & CMS Config Audits: Runs per-framework architecture baselines and configuration audits, plus dedicated rules for known CMS products, with monorepo module scoping and tunable detection modes. - Use Case: Given a RuoYi-Cloud monorepo, probe the project, scope the audit to specific modules, then produce a severity-sorted findings report covering vulnerable dependencies, leaked secrets, and Shiro misconfigurations. ## Quick Start Run a Java static security audit on the project at /path/to/project and summarize all findings by severity.

Frequently Asked Questions about java-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a static security audit on a Java project?▼

Start with java_project_probe on the project root to detect the build system, frameworks, and CMS products. Then follow its recommended_tools list: dependency SCA, hardcoded secrets scan, and per-framework config audits, and finally aggregate findings by severity.

How do I audit a Java monorepo like RuoYi-Cloud?▼

Pass the scope-modules parameter with comma-separated submodule directory names to any audit tool. This restricts scanning to selected modules, and you can verify coverage via meta.files_scanned in the JSON output.

Which Java frameworks are supported for configuration audits?▼

The framework tools support spring_boot, spring_cloud, spring_security, servlet, mybatis, shiro, struts2, jpa, dubbo, jfinal, vertx, and play. Each framework has both an architecture baseline tool and a configuration audit tool selected via the framework parameter.

Can the audit detect hardcoded credentials in Java code?▼

Yes, java_hardcoded_secrets_scan detects hardcoded passwords, API keys, tokens, JDBC credentials, JWTs, and private keys. It accepts the same target and scope parameters as the other tools and returns findings with file and line evidence.

Why does the audit report zero files scanned?▼

A meta.files_scanned value of 0 indicates the scope configuration is wrong, such as an incorrect target path or scope-modules names that do not match actual submodule directories. Verify the absolute project path and module names, then rerun.

How do I reduce false positives in Java security scans?▼

Set the detection-mode parameter to strict to tighten matching rules, or balanced for the default trade-off. You can also use scope-exclude to skip paths like test fixtures and keep dedupe-findings enabled to collapse duplicates.

Related Skills

Explore More Software Engineering Skills→
TheRealSeberTheRealSeber
1

jade-core-build-fixer

Audit and repair Ant, Maven, or Gradle build files for Java 11+ migration.

Community
Advanced
hidonguyenhidonguyen

ck:security

Detect and categorize security vulnerabilities across web application codebases.

Community
Advanced
YehudaFrankelYehudaFrankel
16

security-check

Detect authentication gaps, injection flaws, exposed endpoints, and secrets leakage in code and configurations.

Community
Advanced
3stoneBrother3stoneBrother
876

code-audit

Audit source code for security vulnerabilities across nine languages using dual-track static analysis.

Community
Advanced