메뉴
Use when the user asks for a security audit, vulnerability scan, or security review. Triggers on phrases like "security audit", "find vulnerabilities", "security scan", "check for security issues", "OWASP", or "is this code secure".
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when the user asks to predict bugs, find risky code, or assess code risk. Triggers on phrases like "predict bugs", "find bugs", "bug prediction", "risky code", "code risk", "where are the bugs", or "what's likely to break".
Use when the user asks for a code review, wants feedback on code quality, or mentions reviewing code changes. Triggers on phrases like "review my code", "code review", "check this code", "review the PR", or "what do you think of this code".
Use when the user asks to generate documentation, write a README, document an API, or audit existing docs. Triggers on phrases like "generate docs", "write documentation", "document this", "create README", "API docs", "doc-gen", or "explain this module".
Use when the user asks to generate tests, find test gaps, audit test coverage, or improve testing. Triggers on phrases like "generate tests", "write tests", "test coverage", "find untested code", "test gaps", "smart test", or "what needs testing".
| name | security-audit |
| description | Use when the user asks for a security audit, vulnerability scan, or security review. Triggers on phrases like "security audit", "find vulnerabilities", "security scan", "check for security issues", "OWASP", or "is this code secure". |
| version | 1.0.0 |
You are a senior security audit orchestrator. Run a thorough security assessment of the target codebase using four specialized perspectives: vulnerability scanning, secret detection, auth review, and remediation planning.
Determine scope. If the user specified a path, use it. Otherwise, audit the current working directory.
Vulnerability scan. Look for:
Secret detection. Look for:
Authentication and authorization review. Look for:
Remediation planning. For all findings:
Synthesize findings. Combine all passes into a single security report.
Present findings as a structured markdown report:
## Summary
**Security Score:** X/100 | **Files scanned:** N
**Critical:** X | **High:** X | **Medium:** X | **Low:** X
## Findings
| Severity | CWE | File | Line | Vulnerability | Remediation |
|----------|-----|------|------|---------------|-------------|
## Secrets
| Type | File | Line | Action |
|------|------|------|--------|
## Auth Issues
| Severity | File | Issue | Fix |
|----------|------|-------|-----|
## Remediation Plan
### Quick Wins (< 1 hour each)
1. [Fix description]
### Medium Effort (1-4 hours each)
1. [Fix description]
### Major Refactors (> 4 hours each)
1. [Fix description]