horizon-security-skills - Horizon Studio Security Skills Kit for defensive O

项目说明

<h3 align="center">Horizon Studio Security Skills for</br>Django and React/NextJs</h3>

---

Horizon Security Skills is a defensi collection of OWASP-aligned security workflows for opencode and Codex-assisted projects. It provides installable SKILL.md files for re, fixing, and regression-testing Django/DRF and Next.js/React applications with clear authorization boundaries.

Repository: Horizon-Studio-LTDA/horizon-security-skills

Package: horizon-security-skills@0.2.0

What This Project Provides

Six complete defensi skills for backend and frontend application review.

A Node.js CLI that installs selected skills into .opencode/skills/.

Shared defensi, authorization rules, e rules, se guidance, and report formats.

Templates for security reports, findings, remediation plans, security test plans, executi, and tool results.

Checklists for OWASP, Django/DRF, Next.js/React, SAST, SCA, safe DAST, secrets, Docker, and CI/CD review.

Safe tool usage notes for common defensi and project commands.

A Skills

Backend Django/DRF

backend-django-drf-security-audit

backend-django-drf-security-fix

backend-django-drf-security-fix-and-tests

Frontend Next.js/React

frontend-nextjs-react-security-audit

frontend-nextjs-react-security-fix

frontend-nextjs-react-security-fix-and-tests

Skill Modes

audit: analyzes the project and produces a report; it must not modify source code, configuration, dependencies, migrations, tests, Docker/CI/CD, or credentials. It may create a Markdown report file only when the user explicitly requests or authorizes report file generation.

fix: analyzes and remediates issues only when explicitly authorized.

fix-and-tests: analyzes, remediates, and creates or updates regression tests only when explicitly authorized.

When To Use

Use this project for authorized defensi review of owned or appro.

Use audit skills when you need a read-only OWASP-aligned report with e.

Use fix skills when remediation is explicitly authorized for the current scope.

Use fix-and-tests skills when remediation and regression testing are both explicitly authorized.

Use the shared templates when findings need consistent se, e, remediation, and notes.

When Not To Use

Do not use this project against systems, repositories, en, or data without authorization.

Do not use it as an offensive tool or as a substitute for professional security authorization and scoping.

Do not run DAST against production without explicit production approval.

Do not include secrets, tokens, passwords, private keys, personal data, or sensiti data in prompts, issues, reports, or examples.

Do not treat scanner output as a final conclusion without manual e review.

Installation

List a skills directly from GitHub:

Open interacti mode:

Install all skills:

Install the backend audit skill:

Install the frontend audit skill:

O existing installed skills:

install without a skill opens interactive mode. The CLI asks which skills to install and copies the selected skill directories into .opencode/skills/. By default, the installer does not o existing skill directories. Use --force only when you intentionally want to replace existing installed skills.

See docs/installation.md for additional installation notes.

CLI Usage

The installer writes only to .opencode/skills/ in the current target project. It rejects invalid skill identifiers and refuses to o existing skills unless --force is used or an interacti prompt is confirmed.

See docs/usage.md for usage details.

Manual Installation

Install one skill manually:

Install all skills manually:

The expected installed path is .opencode/skills/<skill-name>/SKILL.md.

Installation Examples

Install only backend audit guidance:

Install only frontend audit guidance:

Refresh every installed skill in a project:

Using With opencode And Codex

For opencode, install the skills into the target project's .opencode/skills/ directory. Then ask for the relevant skill by name or describe the defensive task, authorization, framework, and scope. If a running opencode session does not detect newly installed skills, restart the session.

For Codex-assisted workflows, use this repository as the source of defensi instructions. Reference the relevant skill name, the target framework, the authorized scope, and whether the task is audit, fix, or fix-and-tests.

Repository Structure

bin/: CLI entrypoint.

lib/: CLI support modules for skills, installation, logging, and banner output.

skills/: installable opencode skill directories.

shared/: common methodology, policies, safety boundaries, se model, and e rules.

templates/: report, finding, remediation, test plan, executi, and tool result templates.

checklists/: framework, OWASP, SAST, SCA, safe DAST, secrets, Docker, and CI/CD checklists.

tools/: defensive tool usage notes.

docs/: installation, usage, and security boundary documentation.

Useful internal references:

shared/methodology.md

templates/security-report-template.md

checklists/django-drf-security-checklist.md

checklists/nextjs-react-security-checklist.md

Security And Limits

This project is exclusively defensive. It is not an offensi toolkit and must not be used against targets without authorization.

DAST requires explicit authorization.

Production testing requires explicit production authorization.

Secrets, credentials, tokens, private keys, personal data, and sensiti data must be redacted.

Scanner output is input for analysis, not a final conclusion.

Findings should be e, scoped, and re for false positives.

Remediation must stay within the authorized code and test scope.

See docs/security-boundaries.md for the project security boundaries.

SAST, SCA, And DAST

SAST is core and mandatory when suitable tools are a for the project.

SCA is core and mandatory when dependency manifests or lockfiles exist.

Secret scanning is expected when repository history, configuration, or en examples are in scope.

DAST is optional, safe, non-destructive, and authorized only.

Aggressive DAST, brute force, hea, acti, destructi, unauthorized target testing, and production testing without explicit approval are out of scope.

Recommended external tools are helpful but not mandatory. Missing tools require user authorization before any installation attempt.

Report Artifacts And Language

Reports may be saved as Markdown files when requested or authorized. The default location is:

Example:

If report file generation is not authorized for an audit skill, the report is delivered in the assistant response only. Fix and fix-and-tests skills may sa files inside security-reports/ when requested or authorized, but report generation does not expand remediation scope.

The user can choose report language: English or Português do Brasil. If the user does not specify a language and the skill can ask, it should ask before generating the report. If asking is not practical, the skill should infer the language from the request or con and document that decision in the report.

Missing External Tools

Recommended tools may include semgrep, bandit, pip-audit, gitleaks, detect-secrets, tri audit commands, Docker/Docker Compose when present, and OWASP ZAP Baseline for explicitly authorized safe DAST.

Skills must not install missing external tools automatically. If a recommended tool is missing, the skill should record the tool, explain co impact, ask whether installation is authorized, continue with limited analysis if authorization is absent, and document the limitation.

Reports And E

Reports should clearly separate confirmed findings, suspected findings, false positives, and informational notes. Each finding should include affected files or routes, e, impact, se, confidence, recommended remediation, and status.

Use templates/security-report-template.md as the primary report format. Redact sensiti before including command output, logs, screenshots, or scanner results.

De

See DE.md for local setup, commands, temporary installation tests, Markdown checks, and release-safety review guidance.

Contributing

See CONTRIBUTING.md for contribution scope, security rules, documentation standards, and pull request expectations.

All contributions must remain defensi, and safe for authorized project review.

Security

See SECURITY.md for supported , reporting guidance, sensiti handling, and unsafe-skill reporting.

For conduct expectations, see CODE_OF_CONDUCT.md.

License MIT

Licensed under the terms in LICENSE.md.

项目信息

开发语言：JavaScript

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Horizon Studio Security Skills Kit for defensive OWASP-based audits, remediation workflows, and regression testing in Django/DRF and Next.js/React projects.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	horizon-security-skills - Horizon Studio Security Skills Kit for defensive O
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:20:42
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	341
讨论数量	0
主题状态	正常讨论中