Menu
Two-layer checklist architecture with D1-D10 security coverage matrix and language-specific semantic prompts for gap verification after free audit.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Feature-centric deep incremental security review harness for Git-backed code changes, with autonomous, agents, and hybrid execution modes.
Optional graph-context enrichment for feature-centric incremental security review using CodeGraph or code-review-graph when available.
Pre-report finding verification contract. Re-checks whether each vulnerability has a real external Source, reachable Sink, bypassable or missing sanitization, and practical exploitability before final reporting.
Sink chain deep tracing methodology with graded code output templates (Critical full-chain / High-Medium key-nodes), reverse tracking rules, and per-hop Read verification.
Agent contract templates for R1 and R2+ rounds, including output format, token budget management, truncation defense, and auto-injection prompt templates.
Jalor internal Spring framework audit extension for endpoint operation authorization and service audit logging coverage.
| name | coverage-matrix |
| description | Two-layer checklist architecture with D1-D10 security coverage matrix and language-specific semantic prompts for gap verification after free audit. |
核心原则: Checklist 不驱动审计，而是验证覆盖。LLM 先自由审计(Phase 2A)，再用矩阵查漏(Phase 2B)。
加载时机: Phase 2A（LLM自由审计）完成后 作用: 对照 10 个安全维度 (D1-D10)，标记已覆盖/未覆盖
| # | 维度 | 关键问题 | 已覆盖? | 发现数 |
|---|---|---|---|---|
| D1 | 注入 | 用户输入是否能到达 SQL/Cmd/LDAP/SSTI/SpEL 执行点？ | [ ] | |
| D2 | 认证 | Token/Session 生成、验证、过期是否完整？密钥是否安全？ | [ ] | |
| D3 | 授权 | 每个敏感操作是否验证用户归属？CRUD 权限是否一致？ | [ ] | |
| D4 | 反序列化 | 是否存在不受信数据的反序列化？Gadget 链是否可达？ | [ ] | |
| D5 | 文件操作 | 上传/下载/读取路径是否可控？是否有路径遍历？ | [ ] | |
| D6 | SSRF | 服务端 HTTP 请求的 URL 是否用户可控？协议是否限制？ | [ ] | |
| D7 | 加密 | 硬编码密钥/IV？ECB/CBC-no-MAC？弱KDF？RSA-PKCS1v1.5？证书校验绕过？ | [ ] | |
| D8 | 配置 | 调试接口(Actuator/pprof)是否暴露？CORS 是否过宽？错误堆栈是否泄露？ | [ ] | |
| D9 | 业务逻辑 | 竞态条件？支付金额可篡改？流程可跳过？Mass Assignment？IDOR/水平越权？CRUD 权限注解完整性？数据导出范围？ | [ ] | |
| D10 | 供应链 | 依赖是否有已知 CVE？版本是否在安全范围？ | [ ] |
references/checklists/{language}.md 中对应 ## D{N} 段落的语义提示，补充审计| 主语言 | 语义提示文件 |
|---|---|
| Java | references/checklists/java.md |
| Python | references/checklists/python.md |
| PHP | references/checklists/php.md |
| JavaScript/Node.js | references/checklists/javascript.md |
| Go | references/checklists/go.md |
| .NET/C# | references/checklists/dotnet.md |
| Ruby | references/checklists/ruby.md |
| C/C++ | references/checklists/c_cpp.md |
| Rust | references/checklists/rust.md |
通用维度: references/checklists/universal.md (架构/逻辑级)
coverage_matrix.md，标记已覆盖维度。{language}.md 中对应 ## D{N} 段落（按需加载，非全量）。依赖感知裁剪: 读取 pom.xml/package.json/go.mod 后，D10(供应链)维度中不存在的依赖标记SKIP。
CANDIDATE_LEDGER(candidate_kind=SINK) 完整 + candidate_triage=100% + unchecked=0 + Critical/High 候选 high_path=100%candidate_triage<100% / unchecked>0 / Critical/High Sink 链不完整CANDIDATE_LEDGER(candidate_kind=CONTROL) 完整 + unchecked=0unchecked>0Harness 扩展覆盖追加:
[ACTIVE_EXTENSIONS] 中存在覆盖 D3/D9 的扩展 Skill，D3/D9 覆盖判定必须追加该扩展的 Coverage / Agent Contract requirementsACTIVE_EXTENSIONSCANDIDATE_LEDGER，使用扩展自身的 rule_id，不得只输出百分比CANDIDATE_LEDGER(candidate_kind=CONFIG) 完整 + unchecked=0unchecked>0对每个标记 ✅ 的维度，优先检查 audit_get_candidate_coverage / audit_get_unchecked_candidates。如类别遗漏、候选未入库或仍有 OPEN/TIMEOUT → 降级 ⚠️。
D1(注入) + D2(认证) + D3(授权) 必须覆盖，否则不可进入 REPORT。