메뉴
Project-aware expert-role for security and vulnerability auditing. Reads project docs first, enforces strict boundary controls, OWASP Top 10 mitigation, authentication, and data privacy rules across the codebase.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Language-agnostic endpoint documentation generator. Reads routing and codebase to produce structured API contract documentation for existing endpoints.
Expert-role parity check across project docs, platform instruction surfaces, skills, reusable prompts, workflows, quick-reference material, and implementation evidence when authority depends on the current codebase. Use when checking whether the template system still agrees with itself or when preparing cleanup after major changes.
Project-aware expert-role contract design for APIs, interfaces, repositories, services, message schemas, and module boundaries. Reads project docs first, then produces or reviews a contract consistent with the current repository.
Project-aware expert-role broad verification that reads project docs first, classifies the verification target, and routes to the best specialist skill for executable or non-executable checks across code, contracts, docs, architecture, quality, security, reliability, and project health.
Project-aware expert-role database schema and modeling design. Reads project docs first, then produces a schema design, migration plan, or query optimization strategy consistent with the current repository constraints.
Project-aware expert-role for CI/CD pipeline design and implementation. Reads project docs first, enforces build caching, security gates, test execution, and deployment safety.
| name | security-audit |
| description | Project-aware expert-role for security and vulnerability auditing. Reads project docs first, enforces strict boundary controls, OWASP Top 10 mitigation, authentication, and data privacy rules across the codebase. |
| argument-hint | Point to the code, file, module, or change to audit |
Produces a project-aware, expert-level security audit by reading the repository's project docs first, then applying rigorous threat modeling and vulnerability analysis to the current architecture.
This skill is reusable across application logic, API boundaries, infrastructure configurations, and data persistence layers. It should not assume specific compliance frameworks (like SOC2 or HIPAA) until the project docs explicitly confirm them.
| Document | Why it matters |
|---|---|
docs/project-docs/operations/security-compliance.md | Defines the actual threat model, acceptable risk, security gates, PII masking, data retention, and regulatory requirements. |
docs/project-docs/foundation/architecture.md | Defines trust boundaries, network zones, and where authentication/authorization is enforced. |
docs/project-docs/development/api-contract.md | Clarifies the expected payload shapes and validation rules to prevent injection attacks. |
If the repository lacks the security docs needed for a proper audit, call that out and establish baseline security assumptions before reviewing code.
Use this skill when tasked with identifying vulnerabilities or ensuring code meets security standards.
| Boundary type | Typical artifacts |
|---|---|
| Authentication / Authorization | JWT validation, role-based access control (RBAC), session management. |
| API / Input Validation | Preventing SQL injection, XSS, CSRF, and mass assignment vulnerabilities. |
| Data Privacy / Cryptography | Encryption at rest/transit, hashing algorithms, secret management. |
| Infrastructure Security | Dockerfile security, IAM permissions, network exposure. |
Look for:
Use architecture.md to inspect:
Evaluate auth mechanisms against security-compliance.md:
Also look for:
Ensure: No hardcoded secrets, passwords, or API keys exist in the codebase. Sensitive data is hashed using strong algorithms (e.g., Argon2, bcrypt) with salts. Data in transit is strictly TLS-enforced.
Consult security-compliance.md: Ensure PII is not leaked into application logs, error messages, or third-party analytics tools. Verify data retention constraints are implemented.
Classify findings by severity:
Each finding should include:
architecture.mdWhen using this skill, the output should include:
@agent use security-audit on [Target Component/API] focusing on [Specific Threat/Vulnerability].