mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-14 13:06:30 +03:00
Magnus HedemarkandGitHub
e517f4c551
* feat: add security-audit-methodology skill Signed-off-by: Magnus Hedemark <magnus919@pm.me> * fix: harden portable skill guidance Signed-off-by: Magnus Hedemark <magnus919@pm.me> --------- Signed-off-by: Magnus Hedemark <magnus919@pm.me>
1.4 KiB
1.4 KiB
Vulnerability Classification
CVSS Scoring Guidance
When scoring a finding, use CVSS 3.1 as the common language:
| Severity | Score Range | Meaning |
|---|---|---|
| None | 0.0 | No risk |
| Low | 0.1-3.9 | Limited impact, hard to exploit |
| Medium | 4.0-6.9 | Exploitable with effort, moderate impact |
| High | 7.0-8.9 | Easily exploitable, significant impact |
| Critical | 9.0-10.0 | Wormable, remote code execution, auth bypass |
Finding Severity Triaging
| Priority | Action | SLA |
|---|---|---|
| P0-Critical | Block release, fix immediately | < 24h |
| P1-High | Fix in current sprint | < 1 week |
| P2-Medium | Schedule in next sprint | < 1 month |
| P3-Low | Backlog, address when in area | < 1 quarter |
Common Vulnerability Classes
| CWE Category | What to Look For |
|---|---|
| CWE-20 (Input Validation) | Injection, path traversal, type confusion |
| CWE-79 (XSS) | Unsanitized output, reflected/stored/DOM variants |
| CWE-89 (SQL Injection) | String concatenation in queries, no parameterization |
| CWE-200 (Info Leak) | Stack traces, debug endpoints, verbose errors |
| CWE-287 (Auth) | Weak password policies, missing MFA, session fixation |
| CWE-295 (TLS) | Certificate validation disabled, expired certs |
| CWE-863 (Authorization) | Missing access checks, IDOR, privilege escalation |
| CWE-918 (SSRF) | User-controlled URLs in server-side requests |