메뉴
Deep security audit for the cgov application. Checks secrets, input validation, XSS, API security, wallet integration, and dependency vulnerabilities.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | security-review |
| updated | "2026-02-20T00:00:00.000Z" |
| description | Deep security audit for the cgov application. Checks secrets, input validation, XSS, API security, wallet integration, and dependency vulnerabilities. |
| argument-hint | ["quick|full"] |
| (default | full) |
| allowed-tools | Bash, Read, Grep, Glob, TodoWrite |
Comprehensive security audit tailored for the cgov Next.js application with Cardano wallet integration.
Review each domain. Use Grep to scan files, Read to inspect suspicious findings.
Check for exposed secrets:
src/ for hardcoded strings matching: api[_-]?key, secret, password, token, private[_-]?key (case insensitive).env is in .gitignoreBACKEND_API_KEY is only used in pages/api/ (server-side) and never imported in client componentsnext.config.js — publicRuntimeConfig and NEXT_PUBLIC_* vars must not contain secretsExpected pattern:
// SERVER ONLY (pages/api/*.ts)
const apiKey = process.env.BACKEND_API_KEY;
// CLIENT OK
const backendUrl = process.env.NEXT_PUBLIC_BACKEND_URL; // URLs are OK
Scan all files in src/pages/api/:
| Check | What to Look For |
|---|---|
| Method validation | Every handler should check req.method |
| Input validation | Query params and body should be validated before use |
| Error handling | All routes should have try-catch with generic error messages |
| Status codes | Appropriate codes (400 for bad input, 500 for server errors, not 200 for everything) |
| Backend proxy | Should use callApi() helper, not raw fetch with hardcoded keys |
| Rate limiting | Consider for expensive operations (not required for all routes) |
Anti-pattern to flag:
// BAD — leaks internal error details
res.status(500).json({ error: error.message, stack: error.stack });
// GOOD — generic error
res.status(500).json({ error: 'Internal server error' });
Scan client components for:
dangerouslySetInnerHTML — must NEVER use with user-provided data. OK for trusted static content only.window.location or document.referrer used in renderingSpecial attention to:
Scan src/components/wallet/ and any Mesh SDK usage:
ssr: false)@meshsdk/web3-sdk is loaded via runtime import() gated by window.crypto?.subtlenpm audit --production 2>&1
package-lock.json is committed (prevents supply chain attacks)postinstall scripts from untrusted packagesCheck for sensitive data leaks:
getStaticProps / getServerSideProps — data passed to page props is serialized to HTML. Ensure no server secrets leak.console.log in production can leak data — audit and removeCheck next.config.js and API routes for:
Access-Control-Allow-Origin: *next.config.js headers, verify they're appliedAnywhere user input is processed:
[hash].tsx — the governance action hash)Pattern:
// GOOD — validate before use
const hash = router.query.hash;
if (typeof hash !== 'string' || !hash.match(/^[a-f0-9]{64}$/)) {
return <NotFound />;
}
SECURITY AUDIT
═══════════════════════════════════════
CRITICAL (must fix immediately)
[S1] Description — file:line
HIGH (fix before deployment)
[S2] Description — file:line
MEDIUM (fix when convenient)
[S3] Description — file:line
INFO (recommendations)
[S4] Description
═══════════════════════════════════════
Dependencies: X high, Y critical (npm audit)
Overall: [SECURE / AT RISK / CRITICAL]
For quick argument, only check:
npm audit --productionSkip XSS deep scan, wallet audit, CORS review, and client-side validation review.
Scaffold a new dashboard chart component with registry, types, and proper theme integration.
Create a new customizable dashboard with its own chart registry, provider, and page. Use when adding dashboards like DRep or SPO dashboard.
Context window conservation rules. Invoke when approaching context limits or before large tasks.
Deep reflection on the skill learning system itself. Analyzes what's working, what's stale, and proposes structural improvements. The meta-skill.
End-of-session automation. Creates a journey and evolves skills based on session learnings.
Run the build and intelligently fix TypeScript errors with guardrails. Stops if fixes introduce more errors or the same error persists after 3 attempts.