メニュー
Use when assessing a feature, service, or full repo for security risk. Maps the threat surface, walks the OWASP Top 10, and emits a finding report with severity counts. Suitable as a release-gate skill.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/DeL-TaiseiOzaki/antigravity-orchestra --skill security-auditコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Use to decide when to invoke the Claude Code CLI and how. Claude specializes in deep reasoning — plans, hypercritical reviews, multi-file impact analysis, and pipe-fed log analysis. Includes invocation patterns and cross-check usage with Codex.
Use when an architectural decision has been made or is about to be made. Decides whether the decision belongs in docs/DESIGN.md, what level of detail to record, and what NOT to record. Operates as a judgment skill, not a fixed procedure — for the procedure see the update-design workflow.
Use when evaluating a library, framework, or external service for adoption. Walks evaluation axes (fit, maintenance, license, footprint, integration cost) and produces a recommendation with explicit trade-offs. Output goes under docs/research/.
SOC 職業分類に基づく
SKILL.md を表示中
| name | security-audit |
| description | Use when assessing a feature, service, or full repo for security risk. Maps the threat surface, walks the OWASP Top 10, and emits a finding report with severity counts. Suitable as a release-gate skill. |
List every place untrusted data enters the system: HTTP endpoints, queue consumers, file uploads, env vars read at runtime, third-party webhooks, client-side storage. For each, name the trust boundary it crosses.
For each of: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Identification & Auth Failures, Software / Data Integrity Failures, Security Logging & Monitoring Failures, SSRF — record either a finding or "not applicable, because ".
Grep for committed secrets. Verify .env* is in .gitignore. Check that
the CI logs don't echo env vars.
Run the stack's audit tool (pnpm audit, pip-audit, cargo audit,
govulncheck, dotnet list package --vulnerable). Note severity counts.
Findings: critical=N high=N medium=N low=N
[CRITICAL] <title>
Where: <file:line or component>
Vector: <how an attacker reaches it>
Impact: <what they get>
Mitigation: <smallest viable fix>
Append the OWASP walk as an appendix so reviewers can see what was checked even when there were no findings.