菜单
Use for auth, authorization, tenant isolation, public/private payloads, secrets, supply-chain, source safety, and security review. Do not run production-impacting scans, read secrets unnecessarily, weaken controls, auto-configure tools, or mark metadata-only scanners as approved.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use for governed software work that needs source-of-truth checks, routing, token/context governance, branch/PR discipline, validation honesty, and release readiness. Do not use as approval for writes, installs, migrations, broad plugin use, external tool activation, or global config changes.
Use for React, TypeScript, hooks, tests, build quality, maintainability, AI-generated code risk, and safe quality-gate routing. Do not use to add dependencies, change package managers, reformat broadly, duplicate Superpowers, or rewrite architecture for scanner output.
Use for PR readiness, branch hygiene, checks, review feedback, release gates, publish readiness, and post-merge handoff. Do not push to main, merge with pending required checks, or mark release ready without evidence.
Use for UI/UX authority, visual polish, responsive behavior, accessibility, design-system consistency, workflow clarity, and browser-visible quality. Do not use for backend-only, security-only, release-only, package/config, external design activation, or frontend implementation by default.
基于 SOC 职业分类
| name | security-review |
| description | Use for auth, authorization, tenant isolation, public/private payloads, secrets, supply-chain, source safety, and security review. Do not run production-impacting scans, read secrets unnecessarily, weaken controls, auto-configure tools, or mark metadata-only scanners as approved. |
Use this as the canonical final security review skill for application and toolkit work.
This skill is a review and routing layer. It does not authorize production scans, secret access, policy weakening, external installs, CI edits, MCP setup, global config changes, or tool activation.
.ai-toolkit/methods/security/application-security-readiness.md. Canonical toolkit source: methods/security/application-security-readiness.md.Use scanner metadata only as routing intelligence unless the target project already owns the scanner command or the owner separately approves a scoped scan. Do not use Socket, ZAP, Harden-Runner, deep secret scanners, CI permission changes, or production-impacting scans without explicit approval.
Route WebView, native bridge, token/cookie, deep-link, local-file, and embedded-content risks through .ai-toolkit/methods/security/webview-boundary-review.md. Canonical toolkit source: methods/security/webview-boundary-review.md.
Report findings by severity, coverage, commands run, skipped checks, WARN output, and residual security risk.