메뉴
Produce a PR-style security review of a diff (HEAD vs. base) inside target/, emitting findings in the Anthropic claude-code-security-review JSON schema. Use when the analyst only cares about what changed, not the whole repo.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | security-review |
| description | Produce a PR-style security review of a diff (HEAD vs. base) inside target/, emitting findings in the Anthropic claude-code-security-review JSON schema. Use when the analyst only cares about what changed, not the whole repo. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | anthropics/claude-code-security-review |
/security-review <base-ref>.origin/main (inside target/).BASE="${1:-origin/main}"
# 1. Diff
git -C target diff --unified=0 "$BASE"...HEAD > reports/pr-diff.patch
git -C target diff --name-only "$BASE"...HEAD > reports/pr-files.txt
# 2. Scope scanners to changed files
mapfile -t CHANGED < reports/pr-files.txt
semgrep --config p/security-audit --config p/owasp-top-ten --sarif \
--output reports/pr-semgrep.sarif \
$(printf 'target/%s\n' "${CHANGED[@]}") 2>/dev/null || true
# 3. Narrow secret / dep checks
gitleaks detect --source target --no-git --report-format sarif \
--report-path reports/pr-gitleaks.sarif
# 4. Manual review loop — Claude reads each changed hunk and applies the
# taxonomy below.
Focus only on security implications introduced by the diff. Do not flag pre-existing issues unless they're on the changed path.
eval, XSS (reflected/stored/DOM)Do not report below 0.7 confidence.
reports/pr-findings.json — matches the schema in CLAUDE.md §4:
{
"findings": [
{
"file": "target/src/auth.ts",
"line": 42,
"severity": "HIGH",
"category": "authn_bypass",
"description": "New isAdmin() checks cookie 'role' directly without signature verification.",
"exploit_scenario": "Client sets Cookie: role=admin to bypass authz.",
"recommendation": "Verify JWT signature; read role from verified claims.",
"confidence": 0.95
}
],
"analysis_summary": {
"files_reviewed": 12,
"high_severity": 1,
"medium_severity": 0,
"low_severity": 0,
"review_completed": true
}
}
End by writing the JSON to reports/pr-findings.json and a Markdown comment-
ready summary to reports/pr-review.md.