mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-15 13:36:35 +03:00
Magnus HedemarkandGitHub
e517f4c551
* feat: add security-audit-methodology skill Signed-off-by: Magnus Hedemark <magnus919@pm.me> * fix: harden portable skill guidance Signed-off-by: Magnus Hedemark <magnus919@pm.me> --------- Signed-off-by: Magnus Hedemark <magnus919@pm.me>
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# Vulnerability Classification
|
|
|
|
## CVSS Scoring Guidance
|
|
|
|
When scoring a finding, use CVSS 3.1 as the common language:
|
|
|
|
| Severity | Score Range | Meaning |
|
|
|----------|-------------|---------|
|
|
| None | 0.0 | No risk |
|
|
| Low | 0.1-3.9 | Limited impact, hard to exploit |
|
|
| Medium | 4.0-6.9 | Exploitable with effort, moderate impact |
|
|
| High | 7.0-8.9 | Easily exploitable, significant impact |
|
|
| Critical | 9.0-10.0 | Wormable, remote code execution, auth bypass |
|
|
|
|
## Finding Severity Triaging
|
|
|
|
| Priority | Action | SLA |
|
|
|----------|--------|-----|
|
|
| P0-Critical | Block release, fix immediately | < 24h |
|
|
| P1-High | Fix in current sprint | < 1 week |
|
|
| P2-Medium | Schedule in next sprint | < 1 month |
|
|
| P3-Low | Backlog, address when in area | < 1 quarter |
|
|
|
|
## Common Vulnerability Classes
|
|
|
|
| CWE Category | What to Look For |
|
|
|--------------|-----------------|
|
|
| CWE-20 (Input Validation) | Injection, path traversal, type confusion |
|
|
| CWE-79 (XSS) | Unsanitized output, reflected/stored/DOM variants |
|
|
| CWE-89 (SQL Injection) | String concatenation in queries, no parameterization |
|
|
| CWE-200 (Info Leak) | Stack traces, debug endpoints, verbose errors |
|
|
| CWE-287 (Auth) | Weak password policies, missing MFA, session fixation |
|
|
| CWE-295 (TLS) | Certificate validation disabled, expired certs |
|
|
| CWE-863 (Authorization) | Missing access checks, IDOR, privilege escalation |
|
|
| CWE-918 (SSRF) | User-controlled URLs in server-side requests |
|