菜单
Security review → confirm with user → push branch → open PR with structured body.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Review a pull request or pending changes. Performs a focused code review against the current branch's diff (or staged diff if invoked pre-commit), surfacing correctness bugs, missing tests, style violations, and unclear naming. Use when the user asks to "review this", "review the PR", "code review", or before commits/PRs.
Complete a security review of pending changes on the current branch. Focuses on injection, authn/authz, secrets, SSRF, deserialisation, insecure defaults, and supply-chain risk. Use when the user asks to "security review", "security audit", "check for vulns", or before raising a PR.
Pre-commit gate (fmt + clippy + test) then create a conventional commit with explicit file staging.
Create or update ARCHITECTURE.md with system components, data flows, and ADRs
Format Rust code with rustfmt and report what changed.
Full TDD loop — plan, branch, write code + tests, fmt, clippy, test, review, commit.
基于 SOC 职业分类
| name | pr |
| description | Security review → confirm with user → push branch → open PR with structured body. |
Raise a pull request. Security review runs first, the user confirms the push, then gh opens the PR.
git rev-parse --abbrev-ref HEAD
If the current branch is main (or master): halt. PRs come from feature branches. Tell the user to switch.
Run /security-review against the branch diff (git diff $(git merge-base HEAD main)...HEAD).
Handle findings:
If anything was fixed: re-run /test to confirm no regressions.
This confirmation is per-push. A previous approval does not carry over.
Ask, explicitly: "Ready to push <branch> to origin and open a PR? (yes/no)"
On no: stop and report nothing was pushed.
git push -u origin <branch>
If the remote rejects the push (non-fast-forward, branch protection, etc.): do not force-push. Report the error and ask the user.
Compose the PR body with this structure:
## Summary
- <bullet: what changed, in user-visible terms>
- <bullet: ...>
## Test plan
- [ ] <how to verify the change works>
- [ ] <edge case covered>
- [ ] CI tests pass (`cargo test`, clippy clean, coverage ≥ 80%)
## Security notes
<verbatim output from /security-review — keep the file:line refs>
## Notes
<anything else worth flagging to a reviewer — out-of-scope follow-ups, deferred work, etc. Omit if empty.>
Then (always targets main — do not change base):
gh pr create --base main --title "<conventional commit subject>" --body "$(cat <<'EOF'
<body above>
EOF
)"
Title rules:
[WIP] tags — if it's WIP, use gh pr create --draft.Return the PR URL on its own line so the user can click it. Nothing else needed.
/security-review is clean.main.