菜单
Use for security-sensitive code, external input, authentication, authorization, APIs, uploads, webhooks, secrets, cryptography, dependencies, infrastructure, or pre-merge security review.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | secure-change-review |
| description | Use for security-sensitive code, external input, authentication, authorization, APIs, uploads, webhooks, secrets, cryptography, dependencies, infrastructure, or pre-merge security review. |
Produce a ranked finding table with evidence, exploit preconditions, impact, remediation, regression test, and residual risk. Never infer a clean scan that was not run.
Use when adding modules, dependencies, services, integrations, APIs, persistence, events, queues, or refactoring boundaries. Verifies dependency direction, cohesion, contracts, cycles, and ADR needs.
Use when adding or changing production modules, APIs, jobs, workflows, database operations, external calls, queues, caches, or operational failure behavior.
Use for latency, throughput, CPU, memory, allocations, large datasets, hot loops, serialization, database performance, concurrency, backpressure, caching, or capacity planning.
Use before merging or deploying a substantial feature, service, migration, infrastructure change, performance change, or reliability/security-sensitive fix.
Use to design tests for new behavior, bug fixes, refactors, APIs, migrations, security controls, concurrency, failure handling, observability, accessibility, or performance-sensitive code.
Enforces OWASP-style secure coding, CSP/header preservation, secret hygiene, safe rendering, cookie/privacy rules, and client/server boundaries while building or reviewing Velarro routes, components, forms, modals, drawers, cookies, metadata helpers, image integrations, third-party integrations, headers, middleware, config files, or any code that touches user input or browser security.
