Menu
Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or promote a mgi-link build.
Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.
Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.
Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.
| name | security-review |
| description | Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question. |
-link backend)Follow AGENTS.md first. Backends are unauthenticated by design and reachable only through the router / reverse proxy — the router owns edge auth. "Read-only" is not "safe": returned text and tool descriptions are prompt-injection surfaces. Ground in ../genefoundry-router/docs/SECURITY-ASSESSMENT-2026-06-29.md and ../genefoundry-router/docs/CONTAINER-HARDENING-STANDARD-v1.md.
Authorization to upstreams; use the backend's own credential if any.SafeUrlFetcher pattern).defusedxml; hardened archive extraction.allow_origins=* with allow_credentials=True...); cap unbounded list inputs.cap_drop: ALL, no-new-privileges, resource limits, digest-pinned base, ports: !reset [] expose-only, secrets runtime-only, Trivy gate + SBOM.ports: mapping in the base compose surviving overlay merge — ports: !reset [] is mandatory to drop it.