メニュー
Auto-triggered security checklist. Activates when editing API endpoint files, configuration files, Dockerfiles, or dependency manifests. Runs a structured security review automatically — no slash command needed.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/yogeshhk/TeachingDataScience --skill security-reviewコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Runs deterministic checks against LaTeX teaching/book repos (TeachingQuantumTech, TeachingDataScience, Publications) instead of reasoning about them by reading files. "frames" counts live (uncommented) vs raw \begin{frame} occurrences in one file or a whole directory, since a raw grep count is known to overcount by including commented-out frames; "inputs" transitively walks \input{}/\include{} chains from one or more driver files and flags any target with no matching .tex on disk; "headings" walks the same chain and flags candidate frame titles with manually-assigned numbering (Exercise 1, Lab 2, Step 3...) that makes reordering painful, or that redundantly repeat a word from the deck's own \title{}; "spacing" checks every template_cheatsheet.tex for the compact bullet-list fix (enumitem + \setlist{nosep}). All modes skip backup/_backup/_retired folders. Use this whenever asked to judge a deck's real size, find "how many live frames" in a file, check whether a driver (or a whole repo) has broken/unresolved \i
Domain knowledge for mesh validation thresholds and definitions. Use when adding or reviewing checks in core.py.
Summarizes an stlinspector InspectionReport (JSON) for a non-technical stakeholder. Use when asked to "summarize", "explain", or "triage" an inspection report.
| name | security-review |
| description | Auto-triggered security checklist. Activates when editing API endpoint files, configuration files, Dockerfiles, or dependency manifests. Runs a structured security review automatically — no slash command needed. |
| triggers | ["**/*router*.py","**/*endpoint*.py","**/*api*.py","**/*config*.py","**/Dockerfile*","**/*.env.example","**/requirements*.txt","**/pyproject.toml"] |
This skill runs automatically when the above file patterns are modified.
config.py.env.example uses placeholder values only (e.g., GROQ_API_KEY=your_key_here)USER appuser present)python:latest)ENV in Dockerfile (use runtime injection)pip audit to check for known CVEsFor each item that FAILS, report:
[SECURITY] path/to/file.py:line — Description of issue
Fix: Specific remediation step
If all items PASS, report: "✅ Security checklist passed — no issues found."