القائمة
Use when reviewing AppLoop generated-project actions for path containment, secret exposure, dangerous commands, runtime isolation, and preview iframe boundaries.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when Hermes writes generated Next.js app code: enforce formatting, named exports, component boundaries, route colocation, schema validation, and server action patterns.
Use when applying, previewing, or migrating AppLoop Luma/shadcn themes: registry lookup, light/dark tokens, semantic token preservation, preview, and rollback.
Use when generating or revising AppLoop project UI: define hierarchy, responsive behavior, component map, accessibility, shadcn composition, and semantic class names.
Use when starting, restarting, inspecting, or validating an AppLoop generated project runtime: commands, logs, readiness checks, health checks, and preview-ready events.
Diagnose and recover from ORM migration state drift — when applied migrations don't match tracked state. Covers drizzle-kit + SQLite patterns, Drizzle ORM, and general SQLite schema inspection.
Use when working with AppLoop's chat checkpoint system: auto-save, git file snapshots, edit & resend, new session, DB persistence, and state restoration.
| name | security-review |
| description | Use when reviewing AppLoop generated-project actions for path containment, secret exposure, dangerous commands, runtime isolation, and preview iframe boundaries. |
| version | 1.0.0 |
| author | AppLoop |
| license | MIT |
| metadata | {"hermes":{"tags":["security","isolation","secrets","commands","iframe"],"related_skills":["project-runtime","generated-app-standards"]}} |
Use this skill to review generated-project plans and edits before completion. It mirrors the security auditor agent's checklist in reusable skill form so the UI builder bundle has an explicit security capability.
workspacePath after normalization and realpath resolution./projects/:projectId may modify only that active generated workspace. They must not modify AppLoop source files, templates/, .hermes/, repo docs, package files, or sibling .apploop/projects/* workspaces.NEXT_PUBLIC_HERMES_* is forbidden.:root and .dark token declarations.approved: no blocking issue found.blocked: unsafe operation found; report the violated rule and smallest safe correction.needs-context: missing server-side project context prevents a decision.