メニュー
Security review checklist for web applications. Use when reviewing code for security vulnerabilities, auth issues, input validation, or any security-sensitive code.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
REST API design principles and best practices. Use when designing API endpoints, request/response schemas, versioning, error formats, or reviewing API design.
Python asyncio patterns for high-performance async code. Use when writing async functions, managing concurrency, working with aiohttp, asyncpg, or any async I/O in Python.
Celery background task patterns for Python apps. Use when implementing background jobs, scheduled tasks, email sending, image processing, or any async work that shouldn't block a web request.
Docker, docker-compose, and deployment configuration best practices. Use when writing Dockerfiles, docker-compose.yml, CI/CD configs, or setting up any containerized deployment.
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
End-to-end testing patterns with Playwright. Use when writing browser automation tests, integration tests, testing user flows, or setting up E2E test suites.
| name | security-review |
| description | Security review checklist for web applications. Use when reviewing code for security vulnerabilities, auth issues, input validation, or any security-sensitive code. |
* in production)OWASP Top 10:
1. Broken Access Control — can user A see/edit user B's data?
2. Cryptographic Failures — are secrets/passwords properly protected?
3. Injection — SQL, command, LDAP injection possible?
4. Insecure Design — is auth logic correct by design?
5. Security Misconfiguration — debug mode on? default credentials?
6. Vulnerable Components — any known CVEs in deps?
7. Auth Failures — session fixation? weak tokens?
8. Data Integrity — deserialization attacks? tampered JWTs?
9. Logging Failures — are attacks logged? are secrets in logs?
10. SSRF — can attacker make server fetch internal URLs?
For each finding: [CRITICAL|HIGH|MEDIUM|LOW] file.py:line — description — exact fix recommendation