Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

One-pass CAPEC ingestion → generate per-domain attack pattern taxonomies for PromptKit security audits

未关闭
  • 哪里不对？
#231 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
38/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
python
领域
security, tooling

调研方向

先阅读 #228/#229 中的 CWE 摄取实现，然后检查 CAPEC 下载内容和 schema 参考。将工作分配到 .github/prompts/、.github/skills/、scripts/ingest-capec.py、data/capec/、taxonomies/ 和 manifest.yaml。完成标准是一次运行即可生成按域划分且带版本的 CAPEC 分类体系，并包含 CWE 交叉引用和验证。

由索引模型根据 Issue 内容生成。

描述

Problem / Motivation

PromptKit security audits currently scope what weakness to look for (via CWE taxonomies from #228), but do not scope how attackers exploit those weaknesses. CAPEC (Common Attack Pattern Enumeration and Classification) is the complementary MITRE database that classifies attack patterns — the adversary-side view of CWE weaknesses.

Adding CAPEC-derived taxonomies would let security audit prompts guide the LLM with domain-specific attack patterns, improving threat modeling and exploit path analysis.

CAPEC entries cross-reference CWE IDs, so the two taxonomy sets can be composed: "look for these weaknesses (CWE) using these attack patterns (CAPEC)."

Goal

Implement a pipeline (modeled on the CWE ingestion skill from #228/#229) that:

  1. Ingests the official CAPEC corpus (versioned XML) from MITRE: https://capec.mitre.org/data/downloads.html
  2. In a single run, generates per-domain CAPEC taxonomies (reusing the same 13-domain registry from #228).
  3. Cross-references CWE IDs in each CAPEC entry to enable CWE↔CAPEC composition at audit time.

Deliverables

  • /ingest-capec-taxonomies prompt file (.github/prompts/) and matching CLI skill (.github/skills/)
  • Reusable Python script at scripts/ingest-capec.py
  • Per-domain taxonomy files: taxonomies/capec-<domain>.md
  • Normalized data: data/capec/<version>/
  • Updated manifest.yaml

Design Notes

  • Same architecture as CWE ingestion: 6-phase pipeline (Acquisition → Normalization → Domain Mapping → Taxonomy Generation → Integration → Verification)
  • Same domain registry: Reuse the 13 domains from #228. Consider extracting the registry to a shared data/domain-registry.json so both skills reference the same list.
  • CAPEC XML schema differs from CWE — separate parsing logic required. Key fields: attack pattern ID, name, abstraction, prerequisites, related weaknesses (CWE IDs), execution flow, consequences.
  • Domain mapping: Use CAPEC Related_Weakness CWE cross-references as the primary signal (map CAPEC entries to domains via their associated CWEs). Fall back to CAPEC-specific Prerequisites and Skills_Required fields.
  • Separate skill from CWE ingestion — different input format, different semantics (attack patterns vs weakness classes), different parsing.

External References

Non-Goals

  • Do not merge with the CWE ingestion skill — keep as separate, composable skills.
  • Do not claim exploitability of specific code from attack patterns.
  • Do not fork or maintain a separate CAPEC; track upstream MITRE versions.

Relationship to Other Issues

  • Depends on #228 for the domain registry and taxonomy file conventions.
  • CAPEC taxonomies complement CWE taxonomies — together they scope both the "what" and "how" of security audits.
主要语言
JavaScript
星标
111
派生
24
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/PromptKit 的其他 Issue

查看 microsoft/PromptKit 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。