메뉴
Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when implementing features, fixing bugs, refactoring code, optimizing performance, resolving deprecations, or any multi-step development task requiring planning, implementation, testing, and review. Orchestrates specialized agent teammates through research, architecture, coding, QA, code review, adversarial review, and documentation phases. Triggers on: "implement", "build", "fix bug", "refactor", "add feature", "develop this", "help me build", "add functionality", "optimize performance", "resolve deprecation", "systematic development". Do NOT trigger on: simple questions ("what does this code do?"), file searches ("where is the auth function?"), one-off commands ("run the tests"), code explanations, quick edits, or non-development tasks.
Multi-lens adversarial review with Skeptic, Architect, and Minimalist lenses and 7+ attack vectors
Auto-improve any agent prompt using Karpathy's autoresearch method with iterative test-measure-improve loops
Safety guardrail that blocks destructive commands for the current session
Core development rules and philosophy for coding standards, git practices, and quality guidelines
Directory freeze guardrail that restricts file edits to a specific directory for the current session
| name | security-review |
| description | Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10 |
Provide comprehensive security checklist and patterns when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Triggers on: adding authentication, handling user input, working with secrets, creating API endpoints, implementing payment/sensitive features
Run npm audit, eslint-plugin-security, grep for hardcoded secrets, check exposed env vars. Check each category — injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging. Financial security (atomic transactions, balance checks, rate limiting), blockchain security (wallet signatures, private keys, slippage protection), authentication (JWT validation, session management), database (RLS, parameterized queries), API (auth required, input validation, CORS). Findings by severity (Critical/High/Medium/Low) with: description, impact, proof of concept, remediation code, OWASP/CWE references. No hardcoded secrets — use environment variables Parameterized queries only — no string interpolation in SQL No shell command injection — use libraries, not exec() Hashed password comparison only — never plaintext Authorization check on every protected route Atomic transactions for financial operations with row locks Rate limiting on all financial and auth endpoints XSS prevention — never innerHTML with user input SSRF prevention — validate URLs against domain allowlist Sanitize logs — never log passwords, API keys, or full PII Defense in depth — multiple layers of security Least privilege — minimum permissions required Fail securely — errors must not expose data Don't trust input — validate and sanitize everything Verify context before flagging — not every finding is a vulnerability