菜单
Universal security patterns based on OWASP Top 10 and security best practices. Framework-agnostic.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-patterns |
| version | 1.0.0 |
| description | Universal security patterns based on OWASP Top 10 and security best practices. Framework-agnostic. |
| allowed-tools | Read, Grep, Glob, WebSearch |
| # | Category | Key Check |
|---|---|---|
| A01 | Broken Access Control | Auth checks on every endpoint |
| A02 | Cryptographic Failures | No hardcoded secrets |
| A03 | Injection | Parameterized queries only |
| A04 | Insecure Design | Rate limiting, input validation |
| A05 | Security Misconfiguration | No debug in production |
| A06 | Vulnerable Components | Audit dependencies |
| A07 | Authentication Failures | Brute force protection |
| A08 | Data Integrity | Code signing, safe deserialization |
| A09 | Logging Failures | No sensitive data in logs |
| A10 | SSRF | Validate all URLs |
Compressed-prose response style for the orchestrator (opt-in via behavior.caveman_mode). Drops articles, fillers, and transitional prose; preserves code, paths, JSON/TOML, and quoted text verbatim.
Maestro project patterns — Rust CLI with ratatui TUI, tokio async, Claude CLI process management, and stream-json parsing.
TEMPLATE - Backend API development patterns. Copy and customize for your backend framework (Express, Django, Spring Boot, FastAPI, etc.)
TEMPLATE - Frontend web development patterns. Copy and customize for your frontend framework (React, Vue, Angular, Svelte, etc.)
Defensive patterns for GitHub (gh) and Azure DevOps (az) CLI interactions — error handling, idempotency, rate limits, missing resources.
API contract validation patterns for ensuring client-side models match backend JSON responses. Prevents decoding failures from schema mismatches. Tech-stack agnostic.
