القائمة
Anti-confirmation-bias rules for code audit. Ensures methodology-driven audit approach instead of case-driven, preventing skipping of checklist items or prioritizing familiar patterns.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Feature-centric deep incremental security review harness for Git-backed code changes, with autonomous, agents, and hybrid execution modes.
Optional graph-context enrichment for feature-centric incremental security review using CodeGraph or code-review-graph when available.
Pre-report finding verification contract. Re-checks whether each vulnerability has a real external Source, reachable Sink, bypassable or missing sanitization, and practical exploitability before final reporting.
Sink chain deep tracing methodology with graded code output templates (Critical full-chain / High-Medium key-nodes), reverse tracking rules, and per-hop Read verification.
Agent contract templates for R1 and R2+ rounds, including output format, token budget management, truncation defense, and auto-injection prompt templates.
Jalor internal Spring framework audit extension for endpoint operation authorization and service audit logging coverage.
| name | anti-confirmation-bias |
| description | Anti-confirmation-bias rules for code audit. Ensures methodology-driven audit approach instead of case-driven, preventing skipping of checklist items or prioritizing familiar patterns. |
审计必须由方法论驱动，而非案例驱动。所有审计 Agent 必须遵守。
⚠️ Audit MUST be methodology-driven, NOT case-driven
✗ Do NOT say "基于之前的审计经验，我将重点关注..."
✗ Do NOT prioritize certain vuln types based on "known CVEs"
✗ Do NOT skip checklist items because they seem "less likely"
✓ MUST enumerate ALL sensitive operations, then verify EACH one
✓ MUST complete the full checklist for EACH vulnerability type
✓ MUST treat all potential vulnerabilities with equal rigor
Core principle: Discover ALL potential vulnerabilities, not just familiar patterns.