From oh-my-secuaudit
Static code security audit playbook (SAST, SCA, secret detection) with standardized JSON outputs and reporting. Use for source-code based assessments, schema validation, and generating final reports.
How this skill is triggered — by the user, by Claude, or both
Slash command
/oh-my-secuaudit:sec-audit-staticThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Run the static audit workflow for a codebase: asset identification, API inventory, SAST-style reviews, SCA/secret checks (Gitleaks-first), and report generation using the existing schemas and scripts.
REPORTING_SUMMARY_CONFIG.example.jsonREPORTING_SUMMARY_CONFIG.jsonSEVERITY_CRITERIA_DETAIL.mdUSAGE_EXAMPLES.mdagents/openai.yamlreferences/dependency_audit.mdreferences/env_setup.mdreferences/global_filters.mdreferences/poc_policy.mdreferences/reporting_summary.mdreferences/rule_validation.mdreferences/rules/joern/cors_reflect_origin.screferences/rules/joern/gifticon_sensitive_logging.screferences/rules/joern/java_log_request_response_body.screferences/rules/joern/java_state_change_no_auth.screferences/rules/joern/ocb_file_delete.screferences/rules/joern/open_poc_api_gw_insecure_tls.screferences/rules/joern/open_poc_api_gw_open_redirect.screferences/rules/joern/open_poc_api_insecure_tls.screferences/rules/joern/open_poc_api_log_params.scRun the static audit workflow for a codebase: asset identification, API inventory, SAST-style reviews, SCA/secret checks (Gitleaks-first), and report generation using the existing schemas and scripts.
When installed under ~/.codex/skills/local/sec-audit-static, the skill is fully self-contained:
tools/ (scripts)schemas/references/SEVERITY_CRITERIA_DETAIL.md and reporting config filesYou can run scripts from any working directory by invoking the script path directly, e.g.
~/.codex/skills/local/sec-audit-static/tools/scripts/scan_api.py --repo <target> ....
references/static_sources.md for the canonical docs/prompts/schemas locations.references/static_scripts.md for available automation entrypoints.references/severity_criteria.md plus SEVERITY_CRITERIA_DETAIL.md for risk mapping (5->Critical ... 1->Info).references/reporting_summary.md for the cross-skill summary index format.references/dependency_audit.md for internal dependency checks when requested.references/seed_usage.md for semgrep/joern seed usage rules (2-3/2-4/2-5/2-6).references/poc_policy.md for best-effort PoC generation rules.references/env_setup.md for Docker-preferred environment setup.references/verification_policy.md for commit-specific remediation checks.references/taint_tracking.md for Source->Sink confirmation and rule generation.references/rule_validation.md for mandatory post-rule validation.references/tooling.md for code-browser tooling (rg/ctags).references/zoekt_workflow.md for optional Zoekt-based candidate scoping and fallback rules.references/vuln_automation_principles.md for discovery/analysis split and hypothesis loop.references/global_filters.md for global filter/interceptor verification.references/workflow_comparison.md for before/after operating model deltas.tools/scripts/manage_state_store.py init --repo <path> --run-label <label> and record the returned state_store_run_id in metadata.snapshot_scope=module by default; repo only when needed). Use separate namespace for decompiled artifacts.pageId via Confluence REST API first..env values: CONFLUENCE_BASE_URL, CONFLUENCE_SPACE_KEY, CONFLUENCE_PAT (or CONFLUENCE_TOKEN).GET $CONFLUENCE_BASE_URL/rest/api/content?spaceKey=$CONFLUENCE_SPACE_KEY&title=<URL-encoded-title>&type=page&expand=versionGET $CONFLUENCE_BASE_URL/rest/api/content/search?cql=space=$CONFLUENCE_SPACE_KEY%20AND%20title~%22<keyword>%22pageId and exact title in metadata for report anchors/publishing.tools/scripts/code_search.sh with --engine auto and ZOEKT_ENABLED=1 when Zoekt is available.rg without blocking analysis.tools/scripts/run_zoekt_profile_and_compare.py (api-max fixed profile + auto comparison artifact generation).layer (controller/service/dao/util), boundary (external/network/file/deserialization), and sink_class (exec/eval/sql/fs/net/deserialize). If unknown, use explicit unknown_* values.snapshot|lsp|grep) per edge/candidate.rg/ctags as tertiary. Do not block on higher-tier failures—log the fallback.unknown_context_budget in state store and metadata.appif* + dbif), run a dedicated key-exposure scan across both modules and include results in task outputs.SPRING_ENDPOINT results exist, compare controller classes with inventory results. Record any class-level mismatches and note that FindSecBugs lacks URL patterns (class-only comparison)../gradlew clean assemble -x test or mvn -q -DskipTests package).cfr-0.152.jar) for WAR/JAR; output to <repo>/decompiled.code_search -> Semgrep -> Joern) and compare with source pass.com/skp/ocb/api) for performance.request_mapping in finding JSONs from controller constants when URLs are not already present. Use the repo’s helper if available, e.g. python tools/enrich_request_mapping.py state/task_25_result.json src/main/java/.../ControllerConst.kt. Rerun on any regenerated task JSONs.unknown_no_edges, unknown_dynamic_dispatch, unknown_context_budget, unknown_needs_runtime, unknown_tooling_error, indeterminate_policy, or benign_unreachable instead of a generic unknown.flow (list of steps). If the flow cannot be determined, record a single-step flow explaining why (e.g., "flow not determined: insufficient call-chain context"). Do not omit flow in reports.provenance (binary-confirmed|source-confirmed|runtime-confirmed|not-confirmed)impacted_flow (one or more architecture flow IDs like F1, F2)toSql, String.format, string concatenation, template SQL) even if seeds are empty.metadata.source_repo_url, metadata.source_repo_path, and metadata.source_modules.metadata.report_wiki_url and set metadata.report_wiki_status.request_mapping populated (run the enrichment helper if empty) and rerun tools/scripts/validate_task_output.py.provenance and impacted_flow populated before merge/report.layer, boundary, sink_class (use unknown_* when uncertain) and store short tagging evidence in state store.snapshot_scope and state_store_run_id in metadata.unknown).metadata.* fields. If any are missing, stop and populate them (prefer the actual audited repo path/URL), then re-run tools/scripts/validate_task_output.py.ensure_metadata.py, enrich_request_mapping.py, derive_facets.py, ensure_facets_and_state.py, slice_context.py, scan_authkey_exposure.py (when auth-key material exists), check_finding_consistency.py (wording/runtime/category consistency), check_unknowns.py, validate_task_output.py, rank_candidates.py, high_risk_fuzz_gate.py.tools/scripts/run_static_audit.sh --repo <path> --state-dir <state> --run-label <label> [--snapshot-scope module|repo|decompiled-module|decompiled-repo] (version check, TTL prune, state store init, search, semgrep/joern hooks, slicing/facet/enrichment, validation, summary JSON; heavy steps skippable with flags; override flag for emergency).tools/scripts/merge_results.pytools/scripts/redact.pytools/scripts/validate_task_output.pytools/scripts/generate_finding_report.py
--source-label (use repo URL or a user-facing path label).--anchor-style md2cf를 사용한다. confluence 스타일([[ANCHOR:...]])은 수동 복붙 시 일반 텍스트로 노출될 수 있다.--anchor-prefix <PageTitle>를 정확한 페이지 제목 그대로 전달한다. 스크립트가 이를 Confluence 헤더 ID 규칙(소문자 + 비영문자 제거)으로 정규화해 링크를 생성한다.publish_confluence.py) 전용 흐름에서만 confluence 스타일 앵커를 사용한다.final_report.json + Markdown report.references/severity_criteria.md and detailed criteria in SEVERITY_CRITERIA_DETAIL.md.schemas/reporting_summary_schema.json.Use the existing automation scripts from the repo (see references/static_scripts.md).
tools/scripts/manage_state_store.py (init, add-run, add-candidate, add-artifact, add-coverage, add-log).references/static_sources.md
references/static_scripts.md
references/severity_criteria.md
references/reporting_summary.md
references/dependency_audit.md
references/seed_usage.md
references/poc_policy.md
references/env_setup.md
references/verification_policy.md
references/taint_tracking.md
references/rule_validation.md
references/tooling.md
references/workflow_comparison.md
references/zoekt_workflow.md
references/state_store_spec.md (State Store schema/invariants)
references/state_store_wiring.md (State Store wiring order and command templates)
Include code evidence blocks in findings using the format: FILE + fenced snippet with line numbers.
npx claudepluginhub windshock/oh-my-secuaudit --plugin oh-my-secuauditProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.