security-review

النجوم٣

التفرعات٠

آخر تحديث١٩ مايو ٢٠٢٦ في ١٨:٠٦

Checklist-driven security review pass for pull requests.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

crewship-ai

crewship-ai/crewship

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

محللو أمن المعلوماتمهن الحاسوب والرياضيات·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.

المزيد من هذا المستودع

نفس المستودع

routine-author

crewship-ai/crewship

Author a Crewship routine (repeatable declarative workflow) from a natural-language goal. Use when asked to build, create, or automate a repeatable routine or workflow ("make a routine that…", "automate X", "set up a recurring job that…").

2026-06-303

claude-api

crewship-ai/crewship

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.

2026-05-053

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.