菜单
Review code for quality, security, and best practices. Use when asked to review code, find bugs, or suggest improvements.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run a model through the omni-bench benchmark to MEASURE it — produce a run-artifact and score it, then read the numbers. Use when asked to run, benchmark, measure, evaluate, or "test the results of" a model with omni-bench — ASR (WER/CER, RTFx) or text generation (tok/s, TTFT, prefill tok/s, prompt-cache speedup). Covers the adapter seam (Transcriber/Generator), the prepare→run→score→diff CLI flow, the offline no-download smoke task, and how to interpret each metric. NOT for publishing to a leaderboard (use omni-bench-publish) or changing the framework itself (use omni-bench).
Publish a scored omni-bench result (ASR or text-generation) to a leaderboard platform (e.g. bench.bshk.app) via its write API. Use when asked to publish, upload, submit, or "send a report" for an omni-bench result.json or parity-report.json — sharing ASR WER/RTFx numbers or text-generation TTFT/tok-per-s/prompt-cache numbers. Covers the one modality-agnostic `omni-bench publish` command and the MANDATORY secret handling: the api-key is injected from a secrets manager (1Password `op run` / AgentVault `av run`) at runtime, never read into context, never hardcoded.
Develop the omni-bench benchmark framework (ASR/STT + text generation) built on a producer/scorer split with an open JSON spec as SSOT. Use when working in an omni-bench checkout — changing the JSON schemas, the prepare/producer/scorer/diff pipeline, the adapter seams (Transcriber / Generator), datasets, fixtures, or the Swift producer SDK; or when running and validating benchmark artifacts. Encodes the schema-evolution rules, determinism invariants, commands, and repo gotchas that are easy to get wrong.
Use when generating/managing the offline root signing key or signing & publishing Zamok product keysets from the terminal (the Swift CLI; the ZamokApp GUI is the co-equal interface). Triggers — "generate root key", "rotate root", "publish keyset", "sign keyset", "escrow root key", "zamokctl", "trusted-roots.json", Tish/Zamok license signature setup.
Use when auditing websites or apps for Canadian accessibility law compliance, checking AODA (Ontario) or Accessible Canada Act (federal) requirements, or advising on CAN/ASC-EN 301 549 obligations.
Use when auditing digital products or services for European Accessibility Act (EAA) compliance, checking EN 301 549 conformance, or advising on EU Web Accessibility Directive obligations.
| name | code-reviewer |
| description | Review code for quality, security, and best practices. Use when asked to review code, find bugs, or suggest improvements. |
| version | 1.0.0 |
Provides comprehensive code review capabilities including quality analysis, security scanning, and best practice recommendations.
When reviewing code:
User Request: "Review this login function for security issues"
Response Format:
## Security Review: login()
### Critical Issues
1. **SQL Injection** (Line 15)
- Current: `query = f"SELECT * FROM users WHERE email='{email}'"`
- Fix: Use parameterized queries
### Recommendations
- Add rate limiting
- Implement account lockout