审计代码并生成报告

设置实验室

1. 克隆 Galaxium Travels 存储库。

   git clone -b bob-learning-path-branch https://github.com/IBM/galaxium-travels

2. 点击 File，然后点击 Open Folder。

3. 导航到你克隆的 galaxium-travels 目录并打开它。

4. 通过点击导航栏旁边的 Bob 图标打开 Bob 聊天界面，或使用快捷键 Option + Command + B（macOS）或 Ctrl + Alt + B（Windows）。

5. 在聊天输入字段中，运行 /init 以初始化开发环境并为 Bob 创建 AGENTS.md 文件。如果出现提示，请点击 Approve todo tools for task。

创建审计技能

创建一个技能，这是 Bob 用来完成特定任务的可重用指令集。

以下技能根据 OWASP ASVS Level 1 要求审计 Galaxium Travels 代码库。

该技能检查以下控制：

1. 在聊天界面下方，点击 Bob - Settings，然后点击 Bob Settings。

2. 点击左侧边栏中的 Skills。

3. 点击 + 按钮创建新技能。

4. 在 Skill Name 字段中输入 asvs-audit。这是在聊天中使用 /asvs-audit 调用技能的名称。

5. 在 Description 字段中输入简短描述：

   Audits a codebase against OWASP ASVS Level 1 access control, input validation, API security, and configuration requirements.

6. 确保 Allow Bob to use this skill 切换开关已打开。

   当切换开关打开时，当提示或计划调用时，Bob 可以自行激活技能。你稍后在本教程中创建的审计计划正是这样做的。

7. 将 Scope & Location 更改为 galaxium-travels。

   这会将技能保存在项目的 .bob/skills/ 目录中，因此它仅在此项目中可用，你的团队可以与代码库一起进行版本控制。全局位置 (~/.bob/skills/) 将使技能在你机器上的每个项目中可用。

8. 在 Skill Instructions 文本框中输入以下技能。

   ---
   name: asvs-audit
   description: Audit a codebase against OWASP ASVS Level 1 access control, input validation, API security, and configuration requirements and produce structured findings ready for SARIF and OSCAL export.
   user-invocable: true
   ---
   
   Perform a structured security audit of this codebase. Work through the following phases in order. Do not skip phases or combine them.
   
   ## Phase 1: Discover
   
   Read and understand the application before auditing. Focus on:
   - Entry points: main files, route definitions, controllers
   - Authentication and session handling code
   - Input validation and sanitization code
   - Database query code
   - Any files flagged as high-risk in earlier analysis
   
   Summarize what you find before proceeding to Phase 2.
   
   ## Phase 2: Audit
   
   Check each control below. For each one record: PASS, FAIL, or N/A.
   For every FAIL, record the file path and line number.
   
   ### V4.1 General Access Control
   - V4.1.3 — Users can only access their own resources; other users' data is not accessible
   - V4.1.5 — Access control denies by default — unauthenticated requests are rejected
   
   ### V4.2 Operation Level Access Control
   - V4.2.1 — Sensitive resources cannot be accessed by manipulating a predictable object ID (IDOR protection)
   
   ### V5.1 Input Validation
   - V5.1.1 — All string inputs have defined maximum length constraints
   
   ### V13.1 Generic Web Service Security
   - V13.1.3 — API endpoints do not accept credentials or PII in URL query parameters
   
   ### V14.4 HTTP Security Headers
   - V14.4.1 — HTTP responses include appropriate security headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options
   
   ### V14.5 HTTP Request Header Validation
   - V14.5.3 — CORS origin is validated against an explicit allowlist — wildcard origins are not permitted
   
   ## Phase 3: Generate Findings
   
   For each FAIL, produce a finding in this format:
   
   **Finding [N]:**
   - Rule: ASVS [control number]
   - Severity: Critical / High / Medium / Low
   - File: [path]
   - Line: [number or range, if identifiable]
   - Issue: [one sentence describing what was found]
   - Fix: [one sentence describing the recommended change]
   
   ## Phase 4: Summary
   
   Produce a short summary:
   - Total controls checked
   - Pass / Fail / N/A counts
   - Two-sentence overall security posture assessment
   
   Save the findings to the location specified by the plan or prompt that invoked this skill. Do not generate SARIF, OSCAL, or other report files — report generation is a separate task. Report that the audit is complete and wait for the next instruction.

   这是 Bob 在审计期间遵循的完整指令集。

9. 点击 Create。

查找要审计的高风险区域

为了节省令牌，请让 Bob 识别与安全最相关的文件和文件夹。你将在这些区域运行审计技能。

1. 如果聊天面板尚未打开，请使用 Option + Command + B（macOS）或 Ctrl + Alt + B（Windows）打开它。

2. 从模式选择器中选择 Ask。

   每种模式都有不同的功能和推理风格。Ask 模式最适合问题和分析，但你无法在 Ask 模式下编写或编辑文件。

3. 在聊天输入字段中，输入以下提示以探索代码库并找到最高安全风险区域：

   Explore this codebase as a Senior Security Analyst. Give me a short summary covering:
   
   1. The primary tech stack and framework
   2. Identify the files and folders most relevant to security
   
   Make sure to also review:
   1. How authentication and session management are handled
   2. How user input is accepted and validated
   3. Where database queries are made
   4. Any API endpoints that accept external input
   
   I want to understand the highest security risk areas before running an audit.

   Bob 读取文件并返回应用程序结构的摘要。

创建审计高风险区域的计划

创建 Bob 在审计高风险区域时要遵循的计划。

1. 切换到 Plan 模式。

2. 提示 Bob 创建审计高风险区域的计划。如果出现提示，请点击 Approve todo tools for task。

   Create a plan for auditing the high-risk areas found in the previous
   exploration.
   
   When auditing, use the asvs-audit skill to guide the process.
   
   When the plan runs, create the security/ directory if it does not exist and
   save the findings to security/audit-findings.md
   
   Save the plan to plan/audit-plan.md

3. Bob 可能会提出后续问题以澄清审计范围或要关注的特定区域。你可以回答它们或告诉 Bob use your recommendation。

4. 打开计划文件以了解审计方法以及 Bob 在运行时将执行的操作。

审计代码库

1. 点击 + 按钮开始新任务。

2. 确保你在聊天界面中处于 Agent 模式。

   Agent 模式为 Bob 提供完整的功能，包括文件写入和执行。这对于审计和报告生成阶段是必需的。

3. 点击聊天界面中的 Permissions 选择器，并选中 Read、Edit、Execute 和 Skill 复选框。对于此任务，保持所有其他切换开关未选中。

   权限	状态	原因
   Read	✅ 开启	Bob 读取代码库、审计计划和技能
   Edit	✅ 开启	Bob 将发现写入 security/audit-findings.md
   Execute	✅ 开启	Bob 可能运行 shell 命令来解析路径或确认文件结构
   Skill	✅ 开启	审计计划调用 asvs-audit 技能
   MCP	❌ 关闭	本地代码分析不需要

4. 让 Bob 实施审计计划。

   Implement the @plan/audit-plan.md

5. 在 security/audit-findings.md 中查看发现。

   该计划告诉 Bob 如果 security/ 目录尚不存在则创建它，并将发现保存到 security/audit-findings.md。

   保存发现可以让你使用新的上下文窗口启动与模型的新聊天。你可以将 Bob 指向发现文件以生成报告，而无需重新读取整个代码库和技能指令，这为报告生成保留了上下文窗口。

   上下文窗口注意事项： 所有模型都有设置的上下文窗口。在审计大型代码库时，你可能会超出模型的上下文窗口。对于大型代码库，请尝试一次审计一个 ASVS 类别。首先运行 V4，然后运行 V5、V13 和 V14，最后让 Bob 合并发现。这也是保持 SKILL.md 简洁并使用集中的 @ 上下文提及而不是一次将 Bob 指向整个存储库的好理由。

生成安全报告

SARIF 是静态分析结果的标准交换格式。包括 Bob 在内的 IDE、GitHub Advanced Security 和大多数 CI/CD 管道可以直接使用 SARIF 文件。

1. 点击 + 按钮开始新任务。

2. 确保你使用的是 Agent 模式。

3. 点击聊天面板中的 Permissions，并选中 Read、Edit 和 Execute 复选框。对于此任务，保持所有其他切换开关未选中。

   权限	状态	原因
   Read	✅ 开启	Bob 读取 security/audit-findings.md 中的发现
   Edit	✅ 开启	Bob 将 SARIF 报告写入 security/ 目录
   Execute	✅ 开启	Bob 可能运行 shell 命令来解析路径或确认文件结构
   Skill	❌ 关闭	生成报告不需要。技能已经创建了代理所需的发现
   MCP	❌ 关闭	本地代码分析不需要

4. 使用 @ 上下文提及让 Bob 生成 SARIF 报告。

   @security/audit-findings.md
   
   Generate a SARIF 2.1.0 report from the audit findings.
   
   Save it to `security/audit-results.sarif`.
   
   Include:
   - Tool name: "ASVS Security Audit"
   - A rule entry for each ASVS control that was checked, with the control ID and description
   - A result entry for each finding, with severity level, file path, line number, and the fix recommendation in the message field

   Bob 生成文件并将其保存到 security/audit-results.sarif。确认文件包含一个 runs 数组，其中包含 results 条目，审计中的每个发现一个。

   Bob 还在聊天中报告它做出的映射决策：

   示例输出：

   Severity mapping used: Critical/High → SARIF error; Medium/Low → SARIF warning.
   The message.text for each result contains the full issue description and the fix
   recommendation in one field, so tooling that renders SARIF (GitHub Code
   Scanning, VS Code SARIF Viewer, etc.) will surface the remediation guidance
   inline.

5. 在 Bob 中打开 security/audit-results.sarif 以查看发现。你可以在 GitHub Advanced Security 或 CI/CD 管道等其他工具中使用此文件来显示审计发现。

生成 OSCAL 修复计划 (POA&M)

OSCAL POA&M 是一个机器可读的 JSON 文档，它将每个发现映射到具有风险信息、实施指导和里程碑分配的结构化修复任务。Bob 可以将此文件作为工作队列读取。它处理每个项目，应用修复，并在进行时将里程碑标记为完成。

1. 点击 + 按钮开始新任务。

2. 点击聊天面板中的模式菜单并选择 Agent。

3. 点击聊天面板中的 Permissions，并选中 Read、Edit 和 Execute 复选框。对于此任务，保持所有其他切换开关未选中。

   权限	状态	原因
   Read	✅ 开启	Bob 读取 security/audit-findings.md 中的发现
   Edit	✅ 开启	Bob 将 OSCAL POA&M 写入 security/ 目录
   Execute	✅ 开启	Bob 可能运行 shell 命令来解析路径或确认文件结构
   Skill	❌ 关闭	生成报告不需要。技能已经创建了代理所需的发现
   MCP	❌ 关闭	本地代码分析不需要

4. 使用 @ 上下文提及让 Bob 生成 OSCAL POA&M 报告。

   @security/audit-findings.md
   
   Generate an OSCAL Plan of Action and Milestones (POA&M) from the audit findings.
   
   Save it to `security/poam.json`.
   
   For each finding include:
   - A unique UUID
   - The ASVS control ID as the finding reference
   - Severity and a one-sentence risk description
   - A concrete remediation task with enough detail for an AI agent to implement it without additional context — include file path, line reference, and the specific change required
   - A milestone label based on severity: Critical and High findings get "sprint-1", Medium and Low get "sprint-2"
   
   Use OSCAL version 1.1.2 structure.

   Bob 生成文件并将其保存到 security/poam.json。

   示例输出：

   Each poam-item contains:
   
   props — severity, asvs-control, and milestone label
   risks[] — one risk with a uuid, title, one-sentence risk description, and status: "open"
   
   remediations[] — one remediation with a lifecycle: "planned" flag, a title, and a description
   that is specific enough for an AI agent to implement without additional context
   (includes exact file paths, line numbers, and the concrete code change required)
   
   tasks[] — one or more discrete action tasks under each remediation (e.g. the IDOR finding breaks
   out the short-term ownership check and the long-term UUID migration as separate tasks)

你现在在 security/ 目录中有两个工件：

• audit-results.sarif — 用于开发人员工具和 CI/CD 集成的结构化发现
• poam.json — 用于 AI 辅助或人工驱动修复的修复工作队列

查看发现

生成 POA&M 后，查看发现并确定首先修复哪些发现的优先级。

1. 点击 + 按钮开始新任务。

2. 点击聊天面板中的模式菜单并选择 Ask。

3. 使用 @ 上下文提及让 Bob 突出显示 POA&M 中最关键的项目。

   @security/poam.json
   
   Review this remediation plan and identify the 3 most critical items to fix first.
   
   For each one include:
   - What the vulnerability is and why it is the highest priority
   - Which file and line to look at
   - What the fix involves and roughly how long it would take a developer to implement

   Bob 读取文件并返回优先级摘要：

   示例输出：

   #1 — No Authentication on Any Endpoint (Finding 1 · ASVS V4.1.5 · critical)
   Why it's the highest priority:
   This is the foundational flaw that makes every other vulnerability worse. With
   zero authentication in place, any anonymous caller on the network can execute
   all booking operations — book flights, read all user records, cancel any
   booking, register accounts. Until this is fixed, findings 2 and 3 also have no
   meaningful barrier.
   
   ...snip...
   
   #3 — PII in URL Query Parameters on GET /user (Finding 5 · ASVS V13.1.3 · high)
   Why it's third:
   Email addresses (PII) appearing in GET /user query strings are passively and
   silently leaked into server access logs, reverse-proxy logs, CDN caches, and
   browser history — a persistent, silent data breach that can violate GDPR. Unlike
   findings 2 and 3, this is an architectural leak that accumulates over time;
   every request compounds the exposure.
   
   Sprint-1 Fix Order Summary
   
   Priority    Finding Severity        Effort  Dependency
   1   Auth on all endpoints (V4.1.5)  Critical        2–4 h   None — fix first
   2   Wildcard CORS (V14.5.3) High    30 min  Independent — fix in parallel
   3   PII in query string (V13.1.3)   High    1–2 h   Independent — fix in parallel
   
   Findings 2 and 3 are blockers in the ownership-check fixes (Findings 2 and 3 in
   the POAM) that come afterward, since those require a known caller identity —
   which only exists once authentication (Finding 1) is in place.

   你还可以将 Model Context Protocol (MCP) 服务器集成到你的审计工作流程中，并让 Bob 为每个发现创建工单，将它们链接到相关代码，并包含来自 POA&M 的修复指导。