메뉴
Security review discipline for auth, authorization, injection, secrets, permissions, dependency, supply-chain, privacy, logging, and data exposure risks in high-rigor code and architecture work.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Metric, SQL, dbt, dashboard, semantic-layer, and BI validation discipline for high-stakes analytics work. Use for grain, joins, nulls, filters, freshness, lineage, reconciliation, dashboard semantics, and decision relevance checks.
Compact task-state and handoff ledger for long Opus 4.8 High sessions, subagent orchestration, compaction, and resumable workflows. Use to preserve decisions, files, commands, evidence, risks, and next actions while dropping noisy logs.
Classify high-rigor work into S0-S4 scope levels and choose the minimal sufficient subagent set. Use for ultracode-high orchestration, complex coding, analytics, BI, strategy, writing, audits, migrations, and multi-domain tasks.
Evidence, claim, assumption, and uncertainty ledger for high-rigor agent work. Use when synthesizing research, analytics, code review, strategy, or writing so important claims are labeled as verified, calculated, inferred, assumed, or unknown with source evidence.
Final response contract for ultracode-high and high-rigor subagent workflows. Use to synthesize work into a relayable result with changes, verification, final-gate improvements, risks, and next actions.
Gate vocabulary and runner support for ultracode-high. Use to define precondition and completion gates, prefer deterministic command/file/grep gates where possible, flag attestation gates honestly, and run gates with the bundled gate_check.py helper.
| name | security-rigor |
| description | Security review discipline for auth, authorization, injection, secrets, permissions, dependency, supply-chain, privacy, logging, and data exposure risks in high-rigor code and architecture work. |
| model | claude-opus-4-8 |
| effort | high |
Review the change as an attacker and as an operator responsible for recovery.
This skill is part of ultracode-high. For the full orchestration map, tool
catalog, agent roster, and card schemas, read
../ultracode-high/references/runtime-context.md when available. Security
findings must be concrete enough for the final integrator to block, fix, or
accept explicitly as risk.
Escalate production-affecting or sensitive-data operations for explicit approval.
