Audit Yii2 applications for access control, RBAC, CSRF, and XSS weaknesses.
npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-yii-audit
Please help me install this Agent Skill. Skill: php-yii-audit Source: https://github.com/0xShe/PHP-Code-Audit-Skill/tree/main/php-yii-audit Command: npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-yii-audit
Yii2 projects are prone to misconfigurations in access control (AccessControl/RBAC), CSRF handling, input filtering, output encoding, and unsafe redirects, which can lead to privilege escalation, data leakage, or XSS.
Run the Yii2 audit against your project root to generate framework_audit/yii_{timestamp}.md containing framework-specific risk findings.
High-intent search queries and answers about installing and using this skill.
To audit Yii2 security, run an automated scan against your project root to inspect access control, RBAC, and CSRF handling. The audit identifies misconfigurations across controllers, models, and views, mapping findings to categories like AUTH, CSRF, and XSS.
A Yii2 security audit detects access control and RBAC boundary issues, unsafe CSRF token handling, mass assignment risks from improper input filtering, and XSS from inadequate output encoding in views. It also flags unsafe redirect patterns.
You can check Yii2 RBAC and access control by running an audit that inspects AccessControl configurations, action filters, and matchCallback usage across controllers. This ensures proper authorization boundaries are enforced.
No specific dependencies are required to run the Yii2 security audit. The tool automatically detects Yii framework presence by checking for composer.json with yiisoft/yii2, web/index.php entry, and standard application directories.
To prevent mass assignment in Yii2, an audit assesses input filtering by inspecting rules(), safeAttributes(), and scenarios within your models. This ensures only explicitly allowed attributes are assigned during bulk operations.
To review Yii2 views for XSS, an audit checks output encoding practices and the usage of safe output helpers like Html::encode and HtmlPurifier. Findings are mapped to the XSS vulnerability category for remediation.
WarLikeLauxGuide writing and executing Yii2 tests with Codeception.
ThinkOodleProvides guidance on securing Spring Boot applications with OAuth2 and JWT for stateless authentication and authorization.
Rune-kitRun static analysis tools and normalize findings into unified severity levels.
masanao-ohbaApply security patterns to prevent common PHP vulnerabilities across frameworks.
