القائمة
Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or promote a mgi-link build.
Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.
Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.
Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.
| name | security-review |
| description | Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question. |
-link backend)Follow AGENTS.md first. Backends are unauthenticated by design and reachable only through the router / reverse proxy — the router owns edge auth. "Read-only" is not "safe": returned text and tool descriptions are prompt-injection surfaces. Ground in ../genefoundry-router/docs/SECURITY-ASSESSMENT-2026-06-29.md and ../genefoundry-router/docs/CONTAINER-HARDENING-STANDARD-v1.md.
Authorization to upstreams; use the backend's own credential if any.SafeUrlFetcher pattern).defusedxml; hardened archive extraction.allow_origins=* with allow_credentials=True...); cap unbounded list inputs.cap_drop: ALL, no-new-privileges, resource limits, digest-pinned base, ports: !reset [] expose-only, secrets runtime-only, Trivy gate + SBOM.ports: mapping in the base compose surviving overlay merge — ports: !reset [] is mandatory to drop it.