メニュー
Use for security-sensitive code, external input, authentication, authorization, APIs, uploads, webhooks, secrets, cryptography, dependencies, infrastructure, or pre-merge security review.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when adding modules, dependencies, services, integrations, APIs, persistence, events, queues, or refactoring boundaries. Verifies dependency direction, cohesion, contracts, cycles, and ADR needs.
Use when adding or changing production modules, APIs, jobs, workflows, database operations, external calls, queues, caches, or operational failure behavior.
Use for latency, throughput, CPU, memory, allocations, large datasets, hot loops, serialization, database performance, concurrency, backpressure, caching, or capacity planning.
Use before merging or deploying a substantial feature, service, migration, infrastructure change, performance change, or reliability/security-sensitive fix.
Use to design tests for new behavior, bug fixes, refactors, APIs, migrations, security controls, concurrency, failure handling, observability, accessibility, or performance-sensitive code.
Enforces OWASP-style secure coding, CSP/header preservation, secret hygiene, safe rendering, cookie/privacy rules, and client/server boundaries while building or reviewing Velarro routes, components, forms, modals, drawers, cookies, metadata helpers, image integrations, third-party integrations, headers, middleware, config files, or any code that touches user input or browser security.
| name | secure-change-review |
| description | Use for security-sensitive code, external input, authentication, authorization, APIs, uploads, webhooks, secrets, cryptography, dependencies, infrastructure, or pre-merge security review. |
Produce a ranked finding table with evidence, exploit preconditions, impact, remediation, regression test, and residual risk. Never infer a clean scan that was not run.
