security-review

Estrellas3

Forks0

Actualizado19 de mayo de 2026 a las 18:06

Checklist-driven security review pass for pull requests.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

crewship-ai

crewship-ai/crewship

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.

Más de este repositorio

mismo repositorio

routine-author

crewship-ai/crewship

Author a Crewship routine (repeatable declarative workflow) from a natural-language goal. Use when asked to build, create, or automate a repeatable routine or workflow ("make a routine that…", "automate X", "set up a recurring job that…").

2026-06-303

claude-api

crewship-ai/crewship

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.

2026-05-053

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.