0xSheCommunity·33 Agent Skills Included

PHP-Code-Audit-Skill

White-box PHP security audits with evidence-based vulnerability reports

Audits PHP source code for SQL injection, XSS, SSRF, file upload, deserialization, and 20+ other vulnerability classes. Maps every route, traces data flow from user input to dangerous functions, and checks Laravel, Symfony, WordPress, ThinkPHP, Yii, and CodeIgniter framework risks. Eliminates guesswork by requiring evidence chains before confirming any finding, then produces severity-rated reports with PoCs and fix guidance.

386|38

↗

npx skills add 0xShe/PHP-Code-Audit-Skill --all -g -y

All Skills in This Repository (33)

Pure Emerald Level Indicators

📦 In Repo

0xShe

php-csrf-audit

Analyze PHP source code to verify CSRF protections on state-changing endpoints.

php-exploit-chain-audit

Aggregate PHP vulnerability audit reports into end-to-end exploit chains narratives.

php-nosql-audit

Detect PHP NoSQL injection risks in MongoDB query construction.

php-logging-audit

Detect security logging gaps and sensitive data in PHP applications.

php-logic-audit

Identify and report business-logic flaws in PHP applications.

php-codeigniter-audit

Inspect CodeIgniter projects for CSRF, XSS, and SQL risks.

php-file-upload-audit

Audit PHP source code for file upload vulnerabilities with risk levels and fixes.

php-file-write-audit

Trace user input to file-write sinks in PHP applications.

php-session-cookie-audit

Analyze PHP source code for session and cookie security flaws.

php-thinkphp-audit

Map ThinkPHP security weaknesses to risk categories via static analysis.

php-open-redirect-audit

Audit PHP code for open redirect vulnerabilities from user-controlled destinations.

php-crlf-audit

Identifies CRLF injection vulnerabilities in PHP HTTP headers and cookies.

Community

Advanced

Frequently Asked Questions

FAQPage Schema

How to install PHP-Code-Audit-Skill?▼

Run `npx skills add 0xShe/PHP-Code-Audit-Skill --all -g -y` in your terminal to install all audit skills globally.

How to run a full PHP security audit?▼

Start with the php-audit-pipeline skill and provide your project's source path. It automatically maps routes, traces data flow, runs each vulnerability audit, and merges everything into one report.

What vulnerabilities does it detect?▼

It covers SQL and NoSQL injection, command injection, XSS, SSRF, CSRF, file read/write/upload flaws, deserialization, template injection, XXE, LDAP injection, auth bypass, weak crypto, and business logic bugs.

Does it support Laravel and WordPress?▼

Yes. It includes dedicated framework audits for Laravel, Symfony, WordPress, ThinkPHP, Yii, and CodeIgniter, plus a Composer dependency scanner for known CVEs.

Why do some findings show as unverified?▼

The suite uses an evidence contract: a finding is only marked confirmed when trace evidence fully proves exploitability. Incomplete traces are kept in a pending-risk pool instead of being silently dropped.