القائمة
Pre-launch security review covering auth, data exposure, input validation, and dependency vulns. Produces a remediation list, not a "looks good" stamp.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Slice a goal into the smallest feature slices that can each be PROVEN — every slice ships with a named eval and an end-to-end test, and a slice you can't evaluate or test doesn't get selected. Use after the goal is set and before the spec, so only provable features make the build.
Guided, stateful provisioning of a product's production stack — deep-links, key-format validation, a secrets backend (fnox recommended, or user-touched .env.local), a resumable ledger, CLI automation after signup, and a blocking A1–A10 live gate. Hands off to /security-check → /ship. The walked version of SETUP.md.
Creates specs before coding. Use when starting a new project, feature, or significant change and no specification exists yet. Use when requirements are unclear, ambiguous, or only exist as a vague idea.
Launch the factory's control plane — scaffold and fill FACTORY-ORDERS (weekly mandate + hard budget), STANDING-ORDERS (autonomous-program authority), HEARTBEAT (weekly pulse), and write lifecycle gates for every registered product. A deliberate one-time ritual (re-run to audit); invoke as /factory-launch, not auto-triggered.
One-shot a new product — folders, Next.js starter, product.config.json, CLAUDE.md, scope.md, PRD skeleton, SETUP.md checklist. The Lovable-like ignition.
Breaks work into ordered tasks. Use when you have a spec or clear requirements and need to break work into implementable tasks. Use when a task feels too large to start, when you need to estimate scope, or when parallel work is possible.
| name | security-reviewer |
| description | Pre-launch security review covering auth, data exposure, input validation, and dependency vulns. Produces a remediation list, not a "looks good" stamp. |
| model_tier | opus |
A remediation list saved to products/<name>/decisions/security-review-YYYY-MM-DD.md:
## Security Review — <product> — <date>
### Auth & session
- [ ] <finding> — severity: <crit|high|med|low> — <how to fix>
### Data exposure (API responses, error messages, logs)
- [ ] ...
### Input validation & injection
- [ ] ...
### Secrets & env hygiene
- [ ] ...
### Dependencies & CVEs
- [ ] ...
### Headers, CORS, CSP
- [ ] ...
### Webhooks & external integrations
- [ ] ...
### Rate limiting & abuse
- [ ] ...
## Severity guide
- Critical: ship-blocker (data leak, auth bypass, secret in repo)
- High: fix before next release
- Medium: fix in next sprint
- Low: backlog with date
## Verdict
- BLOCK launch / deploy until <list of critical items> resolved
- OR: clear to ship; medium-and-below items go in the backlog
CLAUDE.md to know the stack and patterns.package.json and pnpm-lock.yaml for dependency baseline.git log -p style scan for accidental commits. .env* in gitignore?pnpm audit mentally — known-vuln packages? Outdated > 1 year?securityheaders.com-equivalent checklist.factory/playbooks/mvp-stage/security-checklist.mdfactory/playbooks/ai-native-2026/founders-playbook-distilled.md (re: insecure by inexperience)