메뉴
全面的安全分析，识别OWASP Top 10漏洞、检测硬编码密钥和审查安全配置。
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
自动分析B站视频内容，下载视频并拆解成帧图片，使用AI分析并生成详细的专题文档或实操教程。
设计RESTful API并生成OpenAPI/Swagger规范文档，遵循行业最佳实践。包括端点命名、请求/响应模式和错误处理模式。
为GitHub Actions、GitLab CI、Azure DevOps和Jenkins生成CI/CD流水线，包含构建、测试、部署阶段、缓存和密钥管理。
全面的代码审查技能，分析代码质量、识别问题、安全漏洞，并提供带严重性评级的改进建议。
设计和优化数据库模式，支持PostgreSQL、MySQL、SQLite和MongoDB。包括ER建模、规范化、索引优化和迁移脚本生成。
创建和管理多容器应用的Docker Compose配置，包含生产级设置、健康检查和网络配置。
| name | security-scanner |
| description | 全面的安全分析，识别OWASP Top 10漏洞、检测硬编码密钥和审查安全配置。 |
| metadata | {"short-description":"扫描代码安全漏洞"} |
Perform security-focused code analysis to identify vulnerabilities and security issues.
/security commandYou are a security expert that identifies vulnerabilities and recommends fixes.
// ❌ VULNERABLE: SQL Injection
const query = `SELECT * FROM users WHERE email = '${email}'`;
// ✅ SAFE: Parameterized query
const query = 'SELECT * FROM users WHERE email = $1';
const result = await db.query(query, [email]);
// ✅ SAFE: Using ORM
const user = await prisma.user.findUnique({ where: { email } });
// ❌ VULNERABLE: XSS in React (rare but possible)
<div dangerouslySetInnerHTML={{ __html: userInput }} />
// ✅ SAFE: Sanitize HTML
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />
// ✅ SAFE: Use text content (React auto-escapes)
<div>{userInput}</div>
// ❌ BAD: Weak password hashing
const hash = crypto.createHash('md5').update(password).digest('hex');
// ✅ GOOD: Strong password hashing
import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(password, 12);
const isValid = await bcrypt.compare(password, hash);
// ✅ GOOD: JWT with proper configuration
import jwt from 'jsonwebtoken';
const token = jwt.sign(
{ userId: user.id },
process.env.JWT_SECRET!,
{ expiresIn: '1h', algorithm: 'HS256' }
);
// ❌ DETECTED: Hardcoded secrets
const API_KEY = 'sk-1234567890abcdef';
const password = 'admin123';
const awsSecret = 'AKIAIOSFODNN7EXAMPLE';
// ✅ SAFE: Environment variables
const API_KEY = process.env.API_KEY;
const password = process.env.DB_PASSWORD;
import helmet from 'helmet';
app.use(helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"],
imgSrc: ["'self'", "data:", "https:"],
},
},
hsts: { maxAge: 31536000, includeSubDomains: true },
noSniff: true,
referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));
// CORS configuration
app.use(cors({
origin: ['https://myapp.com'],
credentials: true,
methods: ['GET', 'POST', 'PUT', 'DELETE'],
}));
import { z } from 'zod';
const CreateUserSchema = z.object({
email: z.string().email().max(255),
password: z.string().min(8).max(100),
name: z.string().min(1).max(100).regex(/^[a-zA-Z\s]+$/),
});
// Validate input
const validated = CreateUserSchema.parse(req.body);
security, vulnerability, owasp, scanning, compliance