Menu
Use for defensive appsec review: auth, secrets, deps, APIs, LLMs, data exposure, OWASP.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Use for /he:plan; stage 1 readiness with Treehouse, Grill Me, owner, proof path, PASS/FAIL.
Use for UI components, design systems, atomic design, tokens, themes, hardcoded visuals, or missing design SSOT.
Use for module boundaries, public APIs, ownership, abstractions, wrappers, test seams, or architecture review.
Use for visual PDFs: create, polish, export, verify decks, reports, proposals, one-pagers, or HTML-to-PDF.
Use for hard bugs, failing behavior, flaky tests, exceptions, regressions, or unexplained slowness before fixing.
Use for real UI E2E smoke/regression proof across web, Flutter, browser, Chrome, or device flows, with artifacts.
| name | security-review |
| description | Use for defensive appsec review: auth, secrets, deps, APIs, LLMs, data exposure, OWASP. |
Run practical defensive triage. Findings need evidence and realistic fix direction. Do not test external targets unless the user owns them or authorization is clear.
Use references/dependency-vulnerability-checks.md when dependency risk matters. Prefer OSV-Scanner plus ecosystem-native audits. Confirm installed version, affected range, fixed version, advisory source, and direct/transitive/prod/dev status before calling a dependency vulnerable.
Read references/checklist.md for detailed checks covering secrets, auth/session, tenant isolation, debug/prod boundary, uploads, supply chain, hygiene, injection, SSRF, XSS, RCE, and LLM/agentic features.
## Findings
- [Severity] <title> - `<path>:<line>` - issue, impact, evidence, fix, verification
## Checked
- Secrets/Auth/Data/Uploads/Deps/Hygiene/Injection/LLM: <checked/finding/not checked + evidence>
## Not checked
- <area> - <reason + residual risk>
Severity: Critical for prod secret/auth bypass/cross-tenant data/RCE/payment/health/admin impact; High for exploitable sensitive BOLA/BOPLA, injection, stored XSS, dangerous upload, SSRF, CI secret exposure, high-impact tool abuse; Medium for plausible hardening gaps; Low for defense-in-depth.