菜单
Comprehensive security audit with OWASP Top 10 analysis. Use when: "security", "vulnerability", "audit", "pentest", "check secrets", "is it secure", "owasp", "security scan"
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Full codebase audit: architecture health, dependencies, complexity, tech debt. Use when: "audit", "health check", "codebase analysis", "tech debt", "architecture review", "dependency check", "code quality"
Structured brainstorming with multiple approaches and tradeoffs. Use when: "brainstorm", "explore options", "what are my options", "compare approaches", "pros and cons", "which is better", "how should I", "alternatives"
Build error diagnosis and resolution. Use when: "build failed", "compile error", "bundler error", "fix build", "npm error", "type error", "won't compile"
Scaffold a new application with interactive dialogue. Use when: "create", "build me", "make an app", "new project", "scaffold", "generate app", "start new"
Generate a new custom skill from natural language description. Use when: "create skill", "new skill", "make a skill", "add command", "custom workflow", "skill template", "generate skill"
Systematic debugging with hypothesis-driven investigation. Use when: "debug", "not working", "bug", "broken", "error", "unexpected behavior", "fix issue", "investigate"
| name | security |
| description | Comprehensive security audit with OWASP Top 10 analysis. Use when: "security", "vulnerability", "audit", "pentest", "check secrets", "is it secure", "owasp", "security scan" |
| argument-hint | [quick|auth|deps|owasp] |
| user-invocable | true |
| disable-model-invocation | true |
$ARGUMENTS
This command performs a comprehensive security audit on the project using security-auditor and penetration-tester agents.
/security - Full security audit
/security quick - Quick scan (secrets + dependencies only)
/security auth - Authentication/authorization review
/security deps - Dependency vulnerability scan
/security owasp - OWASP Top 10 checklist review
When /security is triggered:
Automated scans
# Run security scan script
python .agent/skills/vulnerability-scanner/scripts/security_scan.py .
# Run dependency analysis
python .agent/skills/vulnerability-scanner/scripts/dependency_analyzer.py .
# Check for secrets in code
# (included in security_scan.py)
Agent analysis
security-auditor agent for code reviewpenetration-tester agent for attack surface analysisOWASP Top 10:2025 checklist
| # | Category | Check |
|---|---|---|
| A01 | Broken Access Control | IDOR, auth bypass, SSRF |
| A02 | Security Misconfiguration | Headers, CORS, defaults |
| A03 | Supply Chain | Dependencies, lock files |
| A04 | Cryptographic Failures | Weak crypto, exposed secrets |
| A05 | Injection | SQL, XSS, command injection |
| A06 | Insecure Design | Architecture flaws |
| A07 | Auth Failures | Session, MFA, credentials |
| A08 | Integrity Failures | Unsigned updates |
| A09 | Logging Failures | Missing audit trails |
| A10 | Exceptional Conditions | Error handling, fail-open |
Generate report
## Security Audit Report
### Scan Results
- Security Scan: PASS/FAIL
- Dependency Audit: X vulnerabilities (Y critical)
- Secrets Check: PASS/FAIL
### Findings by OWASP Category
#### A01: Broken Access Control
- [Finding or "No issues found"]
#### A05: Injection
- [Finding or "No issues found"]
[... all categories ...]
### Risk Summary
| Severity | Count | Action |
|----------|-------|--------|
| Critical | X | Fix immediately |
| High | X | Fix before deploy |
| Medium | X | Schedule fix |
| Low | X | Document |
### Recommendations
1. [Priority fix with details]
2. [Secondary fix]
### Next Steps
- [ ] Fix critical findings
- [ ] Re-run `/security quick` to verify
- [ ] Schedule medium/low fixes
/security
/security quick
/security auth
/security deps
/security owasp