メニュー
Use when the user explicitly asks for an OWASP review, OWASP Top 10 analysis, "/owasp", "check OWASP", "OWASP 安全審查", or "OWASP security review". Do not trigger automatically or on generic "security review" requests without OWASP context.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
General assisted review loop for changes — code or design artifacts (specs, plans, docs). Local reviewers answer blind and in parallel on the same unfixed diff, before any fix; the verdict names which reviewers actually ran. Convergence is each reviewer's own explicit per-round verdict, not the facilitator's round-count — the loop runs until-dry (K consecutive rounds where every live reviewer reports converged), with the facilitator owning K and the escalation-to-direction-guard decision. The roster is enrolled per host by `/review-loop:init`, which is never a precondition. For PR/MR targets a forge reviewer follows the local gate; GitHub Copilot is the built-in adapter and needs no enrollment. Findings say what would disprove them, and are reproduced before they are acted on. Never merges autonomously.
Git-native preparation & convergence — carry work forward across the gap when no human is watching, the handoff to a human, and the resume by whoever comes next. Use to prepare work before review, then converge it with the human, or run the lifecycle via `/tsugu:init`, `/tsugu:prepare`, `/tsugu:converge`, `/tsugu:prune`. Triggers on "prepare work before review", "carry work forward", "git-native preparation", "init/prepare/converge/prune", or "/tsugu". Human-triggered and schedule-wireable (wire `prepare` to a driver on the provisioned machine — local cron / `/loop` / `/schedule`). Invokes no user-installed skill by default — native git + its own built-in subagents only. Never auto-merges and never performs public coordination without approval.
Use when reviewing or refactoring React code in pre-RSC projects (classes, hooks, Redux/MobX/observable, Reselect, Immer). Applies FP-thinking rules grounded in render purity, immutable updates, and the Elm Architecture (Model, Msg, update, view, Cmd, Sub). Triggers on phrases like "review my React code", "refactor this class component", "audit hooks usage", "review this reducer", or the slash command `/old-react`. Out of scope: React Server Components, the `use(promise)` hook, `'use client'` and `'use server'` boundaries.
Use when the user asks to "/constraint-generate", "generate constraint tests", "generate constraint artifact", "產生 constraint 的 test", or "generate test from constraint". Reads constraints/*.md and produces deterministic test artifacts.
Use when the user asks to "review my agent", "check if this design is responsible", "who does this affect", "is this agent ethical", "think about the impact", "reflect on this skill", "examine this agent's boundaries", mentions "/kami", "kami", "civic AI", "humane intelligence", "仁工智慧", or wants a Socratic dialogue about human-AI collaboration and stewardship. Other skills may suggest reflection, but only invoke when the user explicitly agrees.
Use when the user asks to "/constraint-enforce", "enforce constraints", "run constraint tests", "跑 constraint 驗證", or "run constraint enforcement". Runs the 4-layer deterministic enforcement pipeline on generated constraint artifacts.
| name | owasp |
| description | Use when the user explicitly asks for an OWASP review, OWASP Top 10 analysis, "/owasp", "check OWASP", "OWASP 安全審查", or "OWASP security review". Do not trigger automatically or on generic "security review" requests without OWASP context. |
You are performing a security review using OWASP frameworks.
Inspired by agamm/claude-code-owasp. Reference data sourced from OWASP GitHub repositories; most references are CC BY-SA 4.0, while the Mobile Top 10 subset is included under assumed (unverified) upstream licensing.
references/INDEX.md to see all available OWASP projects, quick reference tables, and the evolution mapreferences/top10-*/references/cheatsheets-index.md and fetch from upstream URLs as neededreferences/cheatsheets-index.mdFor each finding: