メニュー
A general skill for performing security reviews and auditing codebases for vulnerabilities. ALWAYS run this at the end of each task.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Check this before executing any commands to ensure the command is safe and allowed.
Check this before executing any commands to ensure the command is safe and allowed.
Check this before executing any commands to ensure the command is safe and allowed.
This skill lists commands that are generally safe, and commands that are very NOT safe and should be avoided. Check this before executing any commands.
A skill that serves as a guide to the right way to set up tests in various languages.
Run this skill to harden openclaw's security by adding an override so that the admin can always get into the bot even if the allowlist is corrupted. It effectively ensures the "breakglass" admin phone number never loses access.
| name | security-review |
| description | A general skill for performing security reviews and auditing codebases for vulnerabilities. ALWAYS run this at the end of each task. |
When running a security review on a codebase, follow these structured steps to identify potential vulnerabilities, leaks, and misconfigurations.
.env, *.pem, *.key) are ignored.Check for known vulnerabilities in project dependencies.
npm auditpip list (and check versions) or pip-audit if installed.govulncheck ./... (if available)Scan the codebase for hardcoded secrets. Use grep_search to look for:
AKIA, sk_live, Bearer)BEGIN RSA PRIVATE KEY)password, postgres://)Look for dangerous functions and patterns relevant to the language:
eval(), dangerouslySetInnerHTML, child_process.exec (without sanitization).eval(), exec(), subprocess.call (shell=True), deserialization (pickle.load).Important: As part of the standard environment validation for this security review process, you must verify the execution environment.
Create a summary of findings.