yao-websecurity-skill

1# Yao Websecurity Skill
2 
3## Use
4 
5Use when the user gives a local path, archive, GitHub repo, staging URL, or owned runtime and wants a defensive website security audit, vulnerability checklist review, scorecard, remediation plan, static review, dynamic review, active validation, or Excel/HTML/Markdown/PDF report.
6 
7Do not use for unauthorized targets, exploit development, credential theft, stealth, malware, third-party public-target scanning, or bypass instructions.
8 
9## Required Reading
10 
11- `references/security-audit-method.md`
12- `references/report-contract.md`
13- `references/review-modes.md`
14- `references/vulnerability-ontology.csv`
15- `references/scanner-registry.md`
16 
17## Workflow
18 
191. Confirm mode, scope, authorization, environment, intensity, forbidden actions, test accounts, rate limits, rollback/reset plan, and whether online targets are allowed. Without active-test authorization, use `static`.
202. Prepare an isolated workdir before review: `python3 scripts/security_audit_report.py prepare-env --source "<path-or-url>" --workdir "<fresh-temp-workdir>" --project "<name>" --mode "<mode>"`. Local and GitHub targets must be copied or cloned into this fresh temp directory; never install, build, migrate, write reports, or mutate the original source tree.
21…