l-serim/webauto-audit-skiils

webauto-audit-skiils is a collection of structured security audit reference files built to work with Claude Code, an AI coding assistant. It provides ready to use guidance for finding security vulnerabilities in web application source code across four platforms: PHP, Java.NET, and Node.js. The collection covers 18 common vulnerability types, including SQL injection, command injection, file upload bypasses, deserialization flaws, SSRF, XXE, SSTI, cross site scripting, and authentication bypasses. For each vulnerability type, a file contains the vulnerable code pattern to look for, grep commands that can be run directly against a codebase, and example payloads for testing whether a suspected flaw is real. Framework specific guides cover Laravel, ThinkPHP, Spring Boot, Struts2, Shiro, MyBatis, ASP.NET MVC, WebForms, Express, NestJS, and Next.js. A workflow section provides an 8 layer audit decision tree and vulnerability chaining logic across 9 chain types, showing how lower severity findings can combine into higher impact issues. For dynamic verification, the project includes guidance on using runtime debugging tools so an auditor can confirm a vulnerability in a running application instead of relying only on static code patterns. After a vulnerability is confirmed, the tooling can generate a Python detection or proof of concept script for that specific finding. The files are meant to be copied into Claude Code's skills directory, where the assistant reads them to guide a structured security review. The intended audience is security researchers and developers auditing their own or authorized web application source code. The full README is longer than what was shown.