メニュー
Audit project security posture. Review for OWASP Top 10 vulnerabilities, secrets, injection flaws, and auth gaps. Use --setup to configure security strategy.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | security |
| description | Audit project security posture. Review for OWASP Top 10 vulnerabilities, secrets, injection flaws, and auth gaps. Use --setup to configure security strategy. |
| argument-hint | [feature-name] | --setup | --audit | --diff | --fix |
| context | fork |
Before routing, check if spec/SECURITY_STRATEGY.md exists:
--setup, --audit, --diff, or --fix):
→ Output: "No SECURITY_STRATEGY.md found. Run /security --setup to configure your security strategy, or /security --audit for a project-wide audit." → STOP--setup, --audit, --diff, and --fix modes proceed without strategy file.Parse $ARGUMENTS to determine mode:
--setup: Spawn security-reviewer agent (sonnet) with:
Set up the security strategy for this project.
Ask the user about their security preferences:
1. Compliance requirements (GDPR, HIPAA, PCI DSS, SOC2, or none)
2. Sensitive file patterns (auth, payment, encryption paths — offer sensible defaults)
3. Dependency policy (block critical vulns, auto-update, manual review)
4. Secret management approach (env vars, vault, cloud secrets manager)
5. Custom security rules (project-specific patterns to flag)
6. Severity threshold for reporting (critical, high, medium, low)
Write the result to spec/SECURITY_STRATEGY.md.
--audit: Spawn security-reviewer agent (sonnet) with:
Run a project-wide security audit.
Scan all source files and dependencies.
Write report to spec/SECURITY_REPORT.md.
Do not modify any code.
--diff: Spawn security-reviewer agent (sonnet) with:
Run a security audit on changed files only (git diff).
Report findings for modified files.
Do not modify any code.
--fix: Spawn security-reviewer agent (sonnet) with:
Run a full security audit, then propose fixes for each finding.
Present all findings and proposed remediation to the user.
Apply fixes only after user confirmation for each change.
Feature mode (default — when $ARGUMENTS is a feature name): Spawn security-reviewer agent (sonnet) with:
Run security audit for feature: [feature-name from $ARGUMENTS]
Read spec/SECURITY_STRATEGY.md for rules.
Check all files related to this feature.
Write report to spec/SECURITY_REPORT.md.
Do not modify any code.
Vercel AI SDK expert guidance. Use when building AI-powered features — chat interfaces, text generation, structured output, tool calling, agents, MCP integration, streaming, embeddings, reranking, image generation, or working with any LLM provider.
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines, creates packages, sets up monorepo, shares code between apps, runs changed/affected packages, debugs cache, or has apps/packages directories.
Implement a feature. Supports resuming interrupted work and team mode (--team flag). Reads spec/feature/[name]/spec.md and design.md, generates PLAN.md inside the feature directory, waits for user confirmation, then implements and verifies the feature.
Generate or update MSW mock handlers and fixtures from feature spec API contracts. Use to set up mock infrastructure, generate feature-specific mocks, or check mock status.
AI-driven browser testing against feature specs. Default mode reads spec REQs and autonomously tests in a real browser via Playwright MCP. Also supports running existing Playwright test files, visual regression, and accessibility audits.
Check how well the current implementation matches the feature spec and evaluate code quality. Runs spec compliance review followed by code quality review. Optionally runs unit/integration test audit, logging audit, and security audit when strategy files exist. Does not modify code.