Menu
Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or promote a mgi-link build.
Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.
Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.
Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.
Basé sur la classification professionnelle SOC
| name | security-review |
| description | Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question. |
-link backend)Follow AGENTS.md first. Backends are unauthenticated by design and reachable only through the router / reverse proxy — the router owns edge auth. "Read-only" is not "safe": returned text and tool descriptions are prompt-injection surfaces. Ground in ../genefoundry-router/docs/SECURITY-ASSESSMENT-2026-06-29.md and ../genefoundry-router/docs/CONTAINER-HARDENING-STANDARD-v1.md.
Authorization to upstreams; use the backend's own credential if any.SafeUrlFetcher pattern).defusedxml; hardened archive extraction.allow_origins=* with allow_credentials=True...); cap unbounded list inputs.cap_drop: ALL, no-new-privileges, resource limits, digest-pinned base, ports: !reset [] expose-only, secrets runtime-only, Trivy gate + SBOM.ports: mapping in the base compose surviving overlay merge — ports: !reset [] is mandatory to drop it.