yunmengyaCommunity·18 Agent Skills Included

PHP_AUDIT_SKILLS

Automated full-pipeline PHP security auditing and vulnerability exploitation

Audits PHP projects end to end across six phases: environment setup, static scanning, dynamic tracing, adversarial exploitation, post-exploitation correlation, and reporting. Covers 21 vulnerability types including SQL injection, RCE, deserialization, SSRF, and business logic flaws, eliminating slow manual code review. Produces a complete audit report with Burp reproduction templates, PoC scripts, fix patches, and SARIF export.

80|6

↗

npx skills add yunmengya/PHP_AUDIT_SKILLS --all -g -y

All Skills in This Repository (18)

Pure Emerald Level Indicators

📦 In Repo

yunmengya

php-audit-skills

Automate PHP security auditing with static analysis, dynamic debugging, and Chinese report generation.

php-csrf-audit

Audit CSRF protections in PHP applications and generate JSON and Markdown findings.

php-xss-ssti-audit

Audit PHP codebases for XSS and SSTI vulnerabilities with debug evidence.

ai-audit-mcp

Audit code contexts to identify and report exploitability findings.

php-var-override-audit

Audits PHP variable override risks by tracing controllable inputs and logging evidence chains.

php-serialize-audit

Audit PHP code for deserialization vulnerabilities and POP chain risks.

report-writer-mcp

Aggregate audit findings from JSON files into JSON and Markdown summary reports.

php-rce-audit

Audit PHP projects for command and code execution vulnerabilities.

semgrep-mcp

Scan PHP code with Semgrep CLI and output findings in MCP JSON format.

php-file-audit

Audits PHP code for security vulnerabilities in file operations.

php-vuln-scanner

Scan composer.lock files to identify known PHP dependency vulnerabilities.

php-auth-audit

Audit PHP authentication and authorization logic for missing security checks.

Community

Advanced

Frequently Asked Questions

FAQPage Schema

How to install PHP_AUDIT_SKILLS?▼

Run `npx skills add yunmengya/PHP_AUDIT_SKILLS --all -g -y` in your terminal to install all skills globally. You also need Docker and Docker Compose running on your machine.

How to run a PHP security audit?▼

After installation, simply provide the path to your PHP project and trigger the audit command. The system automatically runs all six phases and outputs a full report with PoC scripts and fix patches.

What vulnerability types does it detect?▼

It covers 21 types including SQL injection, RCE, XSS, SSRF, deserialization, file inclusion, CSRF, weak cryptography, race conditions, and business logic flaws, with framework-aware checks for Laravel, ThinkPHP, Symfony, and WordPress.

Can it resume an interrupted audit?▼

Yes. A checkpoint file records each phase's state, so interrupted audits can resume from the last verified phase, and small code changes can trigger incremental audits.

Do I need security expertise to use it?▼

No. You only provide the project path; the orchestrated agents handle scanning, exploitation, and reporting, delivering a readable report with CVSS scores and reproduction steps.