메뉴
Use when auditing a codebase before it goes public-facing, after a lab build, or on any periodic security pass. Checks secrets in code and history (including Claude Code transcripts), authorization and RLS, input validation, dependency red flags, and exposed endpoints.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when a question has a factual or best-practice answer but a single response might hallucinate, or when the user asks to "get consensus" or "sanity check this with multiple agents". Spawns N subagents on the same question with varied personas and tallies answer frequency.
Use when a question has real trade-offs and no single right answer: architecture choices, library selection, design direction. Runs a multi-round debate where agents see each other's positions across rounds, converge, and a synthesis is produced. For factual questions, use consensus instead.
Use when triaging an inbox: fetching unprocessed emails, classifying each into a label taxonomy, and applying labels via the provider's API. Provider-agnostic skeleton; scripts/label.py must be wired to your email provider before first use.
Use when a workflow built on an MCP server has stabilized and should become a production skill, or when the user says "convert this MCP workflow to a skill". Produces a skill with a bundled script that calls the underlying API directly, eliminating the per-session MCP token overhead.
Use when a PRD or spec exists and needs to become an executable backlog. Breaks the document into GitHub issues structured as vertical-slice tracer bullets, marks each as HITL or AFK, and files a final QA issue. Requires the gh CLI.
Use when implementing any task that should end in a commit. Encodes the definition of done: understand, implement with red-green-refactor for backend logic, run typecheck and tests until clean, then commit. Also the unit of work for autonomous loops.
| name | security-audit |
| description | Use when auditing a codebase before it goes public-facing, after a lab build, or on any periodic security pass. Checks secrets in code and history (including Claude Code transcripts), authorization and RLS, input validation, dependency red flags, and exposed endpoints. |
Run this in a FRESH session. An auditor that helped write the code shares its blind spots. Zero context is the feature: /clear first, or open a new session, then invoke this skill.
Work through all five fronts. For each finding report: severity (critical/high/medium/low), file and line, the attack it enables, and the fix. No hand-waving; every finding gets a concrete fix.
sk-, sk_live, AKIA, ghp_, -----BEGIN, password\s*=, token\s*= with literal values.git log -p | grep for the same patterns. A key deleted in a later commit is still leaked..env is gitignored and no .env* file is tracked.~/.claude session JSONL files forever. Search them: grep -rl "sk-\|sk_live\|AKIA" ~/.claude/projects/ 2>/dev/null. If keys appear, instruct the user to rotate them. Deleting the transcript does not unleak a key.pnpm audit, pip-audit) and triage criticals./dev/* prototypes, and webhook endpoints without signature verification all count as findings.A findings table sorted by severity, then a "fix now" list of the top 3. Offer to fix the top finding immediately.