security-review

Estrelas3

Forks0

Atualizado19 de maio de 2026 às 18:06

Checklist-driven security review pass for pull requests.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

crewship-ai

crewship-ai/crewship

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.

Mais deste repositório

mesmo repositório

routine-author

crewship-ai/crewship

Author a Crewship routine (repeatable declarative workflow) from a natural-language goal. Use when asked to build, create, or automate a repeatable routine or workflow ("make a routine that…", "automate X", "set up a recurring job that…").

2026-06-303

claude-api

crewship-ai/crewship

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.

2026-05-053

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.