Java Auth Config Audit

Q: What does the Java Auth Config Audit AI skill do?

Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发。 覆盖 6 类风险: 认证绕过(Spring Security/Shiro Filter 链 URI 解析差异)、 越权(IDOR/水平越权/垂直越权)、JWT 安全(算法混淆/密钥泄露/Claims 验证)、 加密配置(弱算法/硬编码密钥/不安全随机数)、信息泄露(错误堆栈/Actuator/Debug 模式)、 业务逻辑漏洞(竞争条件/金额篡改/流程绕过)。

OrganizationPopular

wgpsec

java-auth-config-audit

Java 源码认证与配置安全审计。当在 Java 白盒审计中需要检测认证绕过、权限缺陷或安全配置问题时触发。覆盖 6 类风险: 认证绕过(Spring Security/Shiro Filter 链 URI 解析差异)、越权(IDOR/水平越权/垂直越权)、JWT 安全(算法混淆/密钥泄露/Claims 验证)、加密配置(弱算法/硬编码密钥/不安全随机数)、信息泄露(错误堆栈/Actuator/Debug 模式)、业务逻辑漏洞(竞争条件/金额篡改/流程绕过)。

Overview

Publisher	wgpsec
Repository	`AboutSecurity`
Skill name	`java-auth-config-audit`
Stars	1.7K
Forks	242
Bundled files	1
Links	Skill source Repository

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
1 bundled files
Scripts, templates, and references the model can read while it works. Files are read-only and never executed.
Open source
Published by wgpsec on GitHub. Read the source before you install it.

Installation

Install the Java Auth Config Audit AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
Enable the skill in any chat where you want it available.

Store

Installed

Skills

Add skills

Import one or more skills from a public GitHub folder or a local .skill or .zip archive, or SKILL.md file.

From GitHub URLFrom .skill, .zip, or SKILL.md

GitHub repo or folder

https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit

Points to a single skill folder, or any folder that contains multiple skills. Public repos only.

CancelContinue

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/wgpsec/AboutSecurity.git /tmp/AboutSecurity
mkdir -p .claude/skills
cp -r /tmp/AboutSecurity/skills/code-audit/java/java-auth-config-audit .claude/skills/java-auth-config-audit

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Java Auth Config Audit in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Java Auth Config Audit on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Java Auth Config Audit is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Java 认证与配置安全源码审计

Java 后端项目中认证、授权与安全配置是最高频的漏洞产出面。本 skill 提供 6 大类白盒审计的完整检测思路，适用于 Spring Boot/Spring Security、Apache Shiro 及自定义框架。

深入参考

6 类漏洞详细模式（危险代码/安全代码/EVID 证据）-> references/auth-config-patterns.md

6 类风险速查表

#	类别	关键搜索入口	危害等级
1	认证绕过	`SecurityConfig`, `ShiroFilterFactory`, `doFilter`	严重
2	越权	DAO/Mapper 查询语句, `@PreAuthorize`, Controller 参数	高
3	JWT 安全	`Jwts.parser()`, `Algorithm.HMAC`, `SECRET_KEY`	高
4	加密配置	`MessageDigest`, `Cipher.getInstance`, `new Random()`	高
5	信息泄露	`application.yml` Actuator 配置, `@ExceptionHandler`	中
6	业务逻辑	余额/库存操作, 状态机流转, 支付回调	高

1. 认证绕过审计要点

Spring Security: 检查 FilterChainProxy 匹配规则，AntPathRequestMatcher 与 MvcRequestMatcher 差异（尾部斜杠/路径后缀）；requestMatchers 顺序——宽松规则 permitAll() 在前会覆盖后续拦截；permitAll() 是否过度开放（如 /api/**）
Shiro: URI 解析差异导致绕过——/admin/ vs /admin vs /admin/..;/；CVE-2020-1957 / CVE-2020-11989 / CVE-2020-13933 等 path normalization 系列绕过
自定义 Filter: doFilter() 中 early return 导致后续 chain 未执行；白名单正则不严谨（如 startsWith("/public") 可被 /publicevil 匹配）

2. 越权审计要点

水平越权: 接口仅校验登录态未校验资源归属——DAO 层 WHERE id = #{orderId} 缺少 AND user_id = #{currentUserId} 条件
垂直越权: Controller/Service 方法缺少角色注解 @PreAuthorize/@RequiresRoles；枚举值（角色 ID）可猜解
IDOR: 自增 ID 可遍历；UUID 是否真正不可预测；批量接口跳过单条权限检查

3. JWT 安全审计要点

算法混淆: alg: none 绕过签名验证；RS256 -> HS256 攻击（用公钥作为 HMAC 密钥）
密钥硬编码: 源码中 SECRET_KEY = "xxx" 或 application.yml 明文配置
Claims 校验缺失: exp(过期)/iss(签发者)/aud(受众) 未验证导致 token 可跨环境复用
刷新机制: refresh_token 长期有效且未绑定用户/设备，被盗后可无限刷新

4. 加密配置审计要点

弱算法: MD5/SHA1 做密码哈希、DES/RC4 加密、ECB 模式（泄露数据模式）
正确做法: 密码用 bcrypt/scrypt/argon2；对称加密用 AES-GCM/AES-CBC+HMAC
硬编码密钥/盐值: private static final String KEY = "..." 或盐值写死在代码中
不安全随机: java.util.Random 可预测，安全场景必须用 SecureRandom

5. 信息泄露审计要点

Actuator 端点暴露: /env(环境变量/密码)、/heapdump(堆内存含密钥)、/jolokia(远程代码执行)
详细错误堆栈: 全局异常处理器缺失，SQL 报错/类名/路径直接返回客户端
Debug 模式: server.error.include-stacktrace=always、spring.devtools 未移除
敏感数据日志: log.info("用户密码: {}", password) 或完整信用卡号写入日志文件

6. 业务逻辑审计要点

并发竞争: 余额检查与扣款非原子操作（double-spending）；优惠券/积分重放
参数篡改: 金额/数量/折扣由客户端传入且服务端未重新计算；订单金额可为负数
流程绕过: 多步流程（注册-验证-设置密码）步骤间缺少状态校验，可直接跳到后续接口

检测清单

审计时逐项确认，每发现一项即记录 EVID 证据:

Bundled files

The model reads these on demand while the skill is loaded. They are exposed as readable files and are never executed.

references/auth-config-patterns.md13 KB

Frequently asked questions

What does the Java Auth Config Audit AI skill do?

Why use Java Auth Config Audit on TypingMind?

Because you install it once and use it with any model. Java Auth Config Audit is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Java Auth Config Audit in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/wgpsec/AboutSecurity/tree/master/skills/code-audit/java/java-auth-config-audit. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Java Auth Config Audit?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Java Auth Config Audit?

As many as you like. As long as a model supports skills, you can use Java Auth Config Audit with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Java Auth Config Audit AI skill free?

It is published on GitHub by wgpsec. Check the repository for licensing terms. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Security And Hardening

addyosmani

CommunityPopular

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login…

Shipping And Launch

Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up…

Source Driven Development

addyosmani

CommunityPopular

Grounds every implementation decision in official documentation. Use when you want to verify an approach against the official docs before implementing it, or when you want authoritative, source-cited…

Ruview Advanced Sensing

ruvnet

CommunityPopular

Advanced RuView capabilities — RuvSense multistatic sensing (attention-weighted fusion, geometric diversity, persistent field model), cross-viewpoint fusion across multiple nodes, RF tomography (ISTA…

Java Auth Config Audit

Overview