security-review

スター3

フォーク0

更新日2026年5月19日 18:06

Checklist-driven security review pass for pull requests.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

crewship-ai

crewship-ai/crewship

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.

このリポジトリの他の Skills

同じリポジトリ

routine-author

crewship-ai/crewship

Author a Crewship routine (repeatable declarative workflow) from a natural-language goal. Use when asked to build, create, or automate a repeatable routine or workflow ("make a routine that…", "automate X", "set up a recurring job that…").

2026-06-303

claude-api

crewship-ai/crewship

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.

2026-05-053

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.