解放双手 || 全链路 PHP 代码安全审计 AI Agent 系统

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineskills/├── auditors/       — 42 files (21 analyze + 21 attack) + index├── auth/           — 9 sub-skills + index├── correlation/    — 5 correlation rules + index├── infrastructure/ — 4 system skills + index├── qc/             — 6 phase QC checkers + index├── report/         — 7 chapter writers + index├── routes/         — 8 route sub-skills + index├── scanners/       — 7 scanner wrappers + index├── shared/         — 9 cross-cutting protocols + index└── trace/          — 14 trace sub-skills + index

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linePhase-4 攻击循环（每个 Sink，最多 8 轮）：  ┌─ 查询攻击记忆（扁平 + 图记忆）  │    ↓  │  制定攻击计划 → exploit_plan.json  │    ↓  │  ┌─────────────────────────────────────┐  │  │  Round 1~8 循环                      │  │  │  ① Docker 快照                       │  │  │  ② 发送 Payload                      │  │  │  ③ 采集物理证据（HTTP 响应/命令输出） │  │  │  ④ 成功 → 写入 exploit + 记忆        │  │  │  ⑤ 失败 → WAF 分析 → 调整策略        │  │  │  ⑥ 连续失败 → Pivot 转向             │  │  │  ⑦ 触发条件 → Mini-Researcher 委派   │  │  └─────────────────────────────────────┘  │    ↓  │  写入攻击记忆（供后续 Sink 和未来项目复用）  │    ↓  └─ QC 质检 → 下一个 Sink

ounter(lineounter(linedocker --versiondocker compose version

ounter(line/php-audit-skills /path/to/php-project

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linePHP_AUDIT_SKILLS/│├── SKILL.md                          # 主调度器（Skill 入口）├── README.md                         # 本文档├── 全链路详细流程.md                    # 完整执行流程图（文字版）│├── phases/                           # 阶段执行模板（7 个）│   ├── phase1-env.md                 #   环境智能识别与构建│   ├── phase2-recon.md               #   静态资产侦察│   ├── phase2-tasks-dynamic.md       #   动态侦察任务创建│   ├── phase3-trace.md               #   鉴权模拟与动态追踪│   ├── phase4-exploit.md             #   深度对抗审计│   ├── phase45-post.md               #   后渗透智能分析│   └── phase5-report.md              #   清理与报告收口│├── teams/                            # Agent 指令文件（40+ Agents）│   ├── team1/                        #   环境构建（3）│   │   ├── docker_builder.md│   │   ├── env_detective.md│   │   └── schema_reconstructor.md│   ├── team2/                        #   静态侦察（5 dispatchers; scanners in skills/scanners/）│   │   ├── route_mapper.md│   │   ├── auth_auditor.md│   │   ├── dep_scanner.md│   │   ├── context_extractor.md│   │   └── risk_classifier.md│   ├── team3/                        #   动态追踪（3+N）│   │   ├── auth_simulator.md│   │   ├── trace_dispatcher.md│   │   └── trace_worker.md│   ├── team4/                        #   漏洞审计（21+1）│   │   ├── rce_auditor.md│   │   ├── sqli_auditor.md│   │   ├── xss_ssti_auditor.md│   │   ├── lfi_auditor.md│   │   ├── filewrite_auditor.md│   │   ├── ssrf_auditor.md│   │   ├── xxe_auditor.md│   │   ├── deserial_auditor.md│   │   ├── crlf_auditor.md│   │   ├── csrf_auditor.md│   │   ├── authz_auditor.md│   │   ├── session_auditor.md│   │   ├── crypto_auditor.md│   │   ├── race_condition_auditor.md│   │   ├── nosql_auditor.md│   │   ├── ldap_auditor.md│   │   ├── infoleak_auditor.md│   │   ├── logging_auditor.md│   │   ├── config_auditor.md│   │   ├── wordpress_auditor.md│   │   ├── business_logic_auditor.md│   │   └── mini_researcher.md│   ├── team4.5/                      #   后渗透分析（4）│   │   ├── attack_graph_builder.md│   │   ├── correlation_engine.md│   │   ├── poc_generator.md│   │   └── remediation_generator.md│   ├── team5/                        #   报告收口（3）│   │   ├── report_writer.md│   │   ├── sarif_exporter.md│   │   └── env_cleaner.md│   └── qc/                           #   质检（2）│       ├── qc_dispatcher.md│       └── quality_checker.md│├── shared/                           # 共享知识库（25 个）│   ├── anti_hallucination.md         #   反幻觉规则│   ├── attack_chains.md              #   攻击链模式│   ├── attack_memory.md              #   攻击记忆系统（扁平 + 关系型）│   ├── attack_memory_graph.md        #   关系型图记忆模型│   ├── auditor_self_check.md         #   审计员自检清单│   ├── context_compression.md        #   上下文压缩策略│   ├── data_contracts.md             #   数据合约（引用 schemas/）│   ├── docker_snapshot.md            #   Docker 快照管理│   ├── env_selfheal.md               #   环境自愈策略│   ├── error_recovery.md             #   错误恢复指南（5 种场景）│   ├── evidence_contract.md          #   证据采集标准│   ├── false_positive_patterns.md    #   误报模式库│   ├── framework_patterns.md         #   PHP 框架特征模式│   ├── known_cves.md                 #   PHP 生态 CVE 速查│   ├── lessons_learned.md            #   实战经验库│   ├── output_standard.md            #   输出标准规范│   ├── OUTPUT_TEMPLATE.md            #   标准输出模板│   ├── payload_templates.md          #   常用 Payload 模板│   ├── php_specific_patterns.md      #   PHP 特有攻击模式│   ├── pivot_strategy.md             #   Pivot 转向策略│   ├── realtime_sharing.md           #   实时数据共享 + 图节点桥接│   ├── second_order.md               #   二阶漏洞模式│   ├── severity_rating.md            #   严重程度评级体系│   ├── sink_definitions.md           #   Sink 函数定义│   └── waf_bypass.md                 #   WAF 检测与绕过│├── schemas/                          # JSON Schema（30 个）│   ├── attack_graph.schema.json│   ├── attack_memory_entry.schema.json│   ├── auth_credentials.schema.json│   ├── auth_gap_report.schema.json│   ├── auth_matrix.schema.json│   ├── business_logic_result.schema.json│   ├── context_pack.schema.json│   ├── correlation_report.schema.json│   ├── credentials.schema.json│   ├── crypto_audit_result.schema.json│   ├── dep_risk.schema.json│   ├── environment_status.schema.json│   ├── exploit_plan.schema.json│   ├── exploit_result.schema.json│   ├── nosql_result.schema.json│   ├── poc_summary.schema.json│   ├── priority_queue.schema.json│   ├── race_condition_result.schema.json│   ├── remediation_summary.schema.json│   ├── research_result.schema.json│   ├── route_map.schema.json│   ├── shared_findings.schema.json│   ├── team4_progress.schema.json│   ├── trace_record.schema.json│   └── wordpress_result.schema.json│├── references/                       # 参考文档（9 个）│   ├── agent_injection_framework.md  #   Agent 注入框架（L1/L2/L3）│   ├── phase1_environment.md│   ├── phase2_recon.md│   ├── phase3_tracing.md│   ├── phase4_attack_logic.md        #   攻击逻辑 + Mini-Researcher 委派│   ├── phase4_5_correlation.md│   ├── phase5_reporting.md│   ├── pipeline_view.md              #   端到端流水线视图│   └── quality_check_templates.md    #   QC 模板（含图记忆 + 研究员检查）│├── tools/                            # 辅助工具（12 个）│   ├── audit_db.sh                   #   数据库操作（889 行，含图记忆命令）│   ├── audit_monitor.sh              #   审计监控│   ├── sink_finder.php               #   AST Sink 扫描器│   ├── trace_filter.php              #   Xdebug Trace 过滤器│   ├── payload_encoder.php           #   Payload 编码器│   ├── waf_detector.php              #   WAF 指纹识别│   ├── jwt_tester.php                #   JWT 安全测试│   ├── type_juggling_tester.php      #   PHP 类型混淆测试│   ├── redirect_checker.php          #   开放重定向检测│   ├── validate_shared.php           #   shared/ 目录校验│   ├── vuln_intel.sh                 #   漏洞情报收集│   └── quality_report_gen.sh         #   QC 报告生成│├── templates/                        # 环境模板│   ├── .env.template│   ├── Dockerfile.template│   ├── docker-compose.template.yml│   ├── xdebug.ini.template│   └── nginx/                        #   Nginx 框架适配配置│       ├── default.conf│       ├── laravel.conf│       ├── symfony.conf│       ├── thinkphp.conf│       ├── wordpress.conf│       └── yii2.conf│├── assets/                           # 可视化资源│   ├── PHP_AUDIT_SKILLS-pipeline.png│   ├── php-audit-skills-workflow.png│   ├── php-audit-skills-workflow.svg│   └── workflow.mmd│├── agent-flow.mmd                    # Agent 执行流程图（Mermaid）└── audit-flow.mmd                    # 审计流程图（Mermaid）

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 攻击记忆bash audit_db.sh init-memory                     # 初始化（自动含图记忆）bash audit_db.sh memory-write '<json>'            # 写入攻击经验bash audit_db.sh memory-query '<json>'            # 查询匹配经验bash audit_db.sh memory-stats                     # 记忆库统计bash audit_db.sh memory-maintain                  # 清理过期记忆# 图记忆bash audit_db.sh graph-node-write '<json>'        # 写入图节点bash audit_db.sh graph-edge-write '<json>'        # 写入图边bash audit_db.sh graph-neighbors <node_id>        # 查询邻居节点bash audit_db.sh graph-by-data-object <obj>       # 按数据对象查询bash audit_db.sh graph-export <WORK_DIR>          # 导出完整图数据# 发现管理bash audit_db.sh finding-write '<json>'           # 写入发现bash audit_db.sh finding-read [sink_id]           # 读取发现bash audit_db.sh finding-consume <sink_id>        # 消费发现# 质检bash audit_db.sh qc-write '<json>'                # 写入质检记录bash audit_db.sh qc-read [phase]                  # 读取质检记录

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line$WORK_DIR/├── 报告/│   ├── 审计报告.md              ← 全中文单文件报告（含目录/执行摘要/漏洞详情/Context Pack/Burp/攻击链/覆盖率/风险池/经验总结）│   └── audit_report.sarif.json  ← SARIF 2.1.0（可导入 GitHub/VS Code）├── PoC脚本/│   ├── poc_{sink_id}.py         ← 每个漏洞的 PoC│   └── 一键运行.sh              ← 批量执行├── 修复补丁/│   └── {finding_id}.patch       ← 框架适配修复├── 经验沉淀/│   ├── lessons_learned.md       ← 绕过技巧/失败教训/新模式│   └── 共享文件更新建议.md├── 质量报告/│   └── 质量报告.md└── 原始数据/                    ← 中间产物归档    ├── exploits/, traces/, context_packs/    ├── attack_graph.json, correlation_report.json    └── checkpoint.json

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line审计报告.md├── # 封面（项目元数据 + CVSS可视化进度条）├── 📖 目录（7章锚点导航）├── 执行摘要（整体风险等级 + 关键发现 + 审计范围）├── 漏洞汇总表（CVSS进度条 + AI验证徽章）├── 漏洞详情 ×N│   ├── 📋 漏洞信息卡（等级/类型/路由/Sink/鉴权/优先级）│   ├── 📦 上下文包（入口→调用链→Sink + 中间件 + 过滤器 + 认证绕过）│   ├── 🔗 Mermaid 攻击链│   ├── 📊 数据流追踪（Source→Sink + file:line）│   ├── 🔫 Burp 复现模板（请求 + 响应）│   ├── ⚔️ 攻击迭代记录│   └── 🔧 修复方案（❌修复前 vs ✅修复后）├── 联合攻击链分析（Mermaid + 步骤表）├── 审计覆盖率统计（路由/优先级/审计器状态）├── 待补证风险池（降级原因 + 复验建议）├── 审计经验总结（框架特征/绕过手法/踩坑/建议）└── 📋 页脚（版本 + 时间 + 工具）

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line输入: /php-audit-skills <目标路径>  ↓前置检查: Docker → 路径验证 → WORK_DIR → 断点续审 → 增量审计  ↓Phase 1: env-detective ∥ schema-reconstructor → docker-builder → QC  ↓Phase 2: scanners ×7 ∥ route-mapper ∥ auth-auditor ∥ dep-scanner         → context-extractor → risk-classifier → QC → 动态创建 Phase-4 任务  ↓Phase 3: auth-simulator → trace-dispatcher → trace-worker×N → QC  ↓Phase 4: Step1 并行分析（21 专家） → Step2 串行攻击（8 轮循环 + Pivot）         → 攻击记忆写入 → QC（完成一个校验一个）  ↓Phase 4.5: attack-graph-builder ∥ correlation-engine           → poc-generator ∥ remediation-generator  ↓Phase 5: env-cleaner ∥ report-writer ∥ sarif-exporter → 最终 QC  ↓输出: 报告/审计报告.md + 报告/audit_report.sarif.json + PoC脚本/ + 修复补丁/ + 经验沉淀/ + 质量报告/