security-audit
GitHub提供LLM Gateway的安全最佳实践、漏洞审查及完整安全审计。覆盖认证、API密钥等敏感代码编写，支持被动扫描、指导咨询及全面渗透测试与月度例行审计任务。
触发场景
安装
npx skills add theopenco/llmgateway --skill security-audit -g -y
SKILL.md
Frontmatter
{
"name": "security-audit",
"description": "Security best practices, vulnerability review, and full security audits for LLM Gateway. Use when writing security-sensitive code (auth, sessions, API keys, provider keys, billing, webhooks, user-supplied URLs, admin routes, CORS, rendering user content), when asked for a security review, security report, vulnerability research, pen test, or security audit, and for the monthly audit routine that fixes confirmed findings in a PR."
}
Security audit
Merged from OpenAI's security-best-practices (secure defaults per framework)
and Cloudflare's security-audit (evidence-first audit workflow). Licenses:
LICENSE-openai (Apache-2.0, files under references/) and
LICENSE-cloudflare (MIT, the upper-case companion files, validators, and
report-schema.json).
Pick the mode
| Request | Mode | Load |
|---|---|---|
| Writing or changing code | Secure by default | Matching references/ file |
| Working nearby and something looks wrong | Passive | Flag critical issues only; ask before fixing |
| Security question, focused review, triage | Guidance | Relevant companions from the table below |
| "Audit", "pen test", full/comprehensive review | Full audit | AUDIT-WORKFLOW.md, all six phases |
| Monthly routine | Routine | Full audit (quick profile), then Fix |
If a request could mean guidance or full audit, ask one question first.
Framework references
This repo is TypeScript: Hono APIs (apps/api, apps/gateway), Next.js App
Router frontends, React. Read every matching file before writing or reviewing
code in that stack:
references/javascript-typescript-nextjs-web-server-security.mdreferences/javascript-typescript-react-web-frontend-security.mdreferences/javascript-general-web-frontend-security.mdreferences/javascript-express-web-server-security.md— no Hono guide exists; apply its middleware, input, header, and error-handling rules to Hono.
Project rules override generic advice. Do not report missing TLS, Secure
cookies on local dev, or missing HSTS as findings. A best practice without a
reachable boundary violation is not a finding (see Anti-patterns in
AUDIT-WORKFLOW.md).
Audit companions
| Companion | Covers |
|---|---|
| RECONNAISSANCE.md | Phase 1: boundaries, ledger |
| HUNTING.md, ATTACK-CLASSES.md | Phase 2: hunter waves |
| VALIDATION-AND-REPORTING.md | Phases 3-6: verify, findings.json, report |
| WEB-PROTOCOL-AND-AUTH.md | Sessions, auth, CSRF, CORS, redirects |
| DATA-ISOLATION-AND-LIFECYCLE.md | Org/project tenancy, deletion, exports |
| AI-AND-LLM.md | Prompt injection, tool calls, model output handling |
| RESOURCE-EXHAUSTION-AND-AVAILABILITY.md | Rate limits, unbounded work, cost abuse |
| CLIENT-SIDE.md | XSS, postMessage, client storage |
| CLOUD-AND-DEPLOYMENT.md | infra/, containers, secrets |
| SUPPLY-CHAIN-AND-RELEASE.md | .github/workflows, dependencies, publishing |
| PROTOCOLS-RPC-AND-MESSAGING.md | Webhooks, MCP, queues |
| DESKTOP-MOBILE-AND-LOCAL-IPC.md | apps/mobile |
| MEMORY-SAFETY-AND-BINARY.md | Native code, parsers (rarely relevant here) |
High-value surfaces in this repo
Seed reconnaissance from these; they are not the whole attack surface.
- Auth and sessions:
apps/api/src/auth/(better-auth),apps/api/src/middleware/admin.ts. - Tenancy: every
apps/api/src/routes/handler taking an org, project, or key id must check the caller's membership. Cross-tenant read or write is high. - Gateway keys and limits:
apps/gateway/src/key/,packages/shared/src/api-key-hash.ts,apps/gateway/src/middleware/org-rate-limit.ts,apps/gateway/src/middleware/cors.ts. - Provider credentials:
packages/actions/src/provider-key/(crypto.ts,redact.ts),apps/api/src/routes/keys-provider.ts. Keys must never reach logs or responses. - User-supplied URLs (SSRF):
packages/actions/src/process-image-url.ts,packages/shared/src/url-safety-node.ts,apps/api/src/routes/platform-webhooks.ts. Rules live in thegatewayskill. - Billing:
apps/api/src/stripe.tswebhook signature handling, credit math (billingskill). - Client IP trust:
packages/shared/src/client-ip.ts(infrastructureskill). - MCP:
apps/gateway/src/mcp/. - Admin:
ee/admin,apps/api/src/routes/admin*.ts. - Rendered user or model content: grep
dangerouslySetInnerHTMLinapps/andee/.
Running a full audit
Follow AUDIT-WORKFLOW.md. Write the run directory outside the repo
(default ~/security-audit-skill/llmgateway/run-<N>) or under the worktree's
.context/, which .gitignore excludes. Validate before reporting:
node .agents/skills/security-audit/validate-findings.cjs <run-dir>/findings.json
node .agents/skills/security-audit/validate-coverage-ledger.cjs <run-dir>/coverage-ledger.json
Never commit findings.json or reports: they describe unfixed vulnerabilities.
Share them only in private channels. SECURITY.md governs external disclosure.
Fix
Fix only confirmed findings, one finding per commit, smallest change at the
last trusted decision point, with a regression *.spec.ts next to the code.
Check callers so the fix does not break legitimate flows. Run the testing
skill's isolated tests and pnpm build, then open a PR with the pull-request
skill. The PR body names each fixed finding by title and severity only, never
a working exploit. Leave needs_validation records out of the PR; list them for
a human.
版本历史
- d41bf19 当前 2026-10-19 04:13
