菜单
Security review checklist for web applications. Use when reviewing code for security vulnerabilities, auth issues, input validation, or any security-sensitive code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
REST API design principles and best practices. Use when designing API endpoints, request/response schemas, versioning, error formats, or reviewing API design.
Python asyncio patterns for high-performance async code. Use when writing async functions, managing concurrency, working with aiohttp, asyncpg, or any async I/O in Python.
Celery background task patterns for Python apps. Use when implementing background jobs, scheduled tasks, email sending, image processing, or any async work that shouldn't block a web request.
Docker, docker-compose, and deployment configuration best practices. Use when writing Dockerfiles, docker-compose.yml, CI/CD configs, or setting up any containerized deployment.
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
End-to-end testing patterns with Playwright. Use when writing browser automation tests, integration tests, testing user flows, or setting up E2E test suites.
| name | security-review |
| description | Security review checklist for web applications. Use when reviewing code for security vulnerabilities, auth issues, input validation, or any security-sensitive code. |
* in production)OWASP Top 10:
1. Broken Access Control — can user A see/edit user B's data?
2. Cryptographic Failures — are secrets/passwords properly protected?
3. Injection — SQL, command, LDAP injection possible?
4. Insecure Design — is auth logic correct by design?
5. Security Misconfiguration — debug mode on? default credentials?
6. Vulnerable Components — any known CVEs in deps?
7. Auth Failures — session fixation? weak tokens?
8. Data Integrity — deserialization attacks? tampered JWTs?
9. Logging Failures — are attacks logged? are secrets in logs?
10. SSRF — can attacker make server fetch internal URLs?
For each finding: [CRITICAL|HIGH|MEDIUM|LOW] file.py:line — description — exact fix recommendation