security-deep

Use for security audits, vulnerability analysis, threat modeling, compliance, and incident response. Triggers on OWASP, XSS, SQL injection, CSRF, security audit, penetration testing, pen test, CVE, vulnerability, threat model, security review, SOC2, GDPR, PCI-DSS, HIPAA, compliance audit, CSP headers, HSTS, CORS policy, RBAC, ABAC, key rotation, encryption, AES-256, TLS, mTLS, bcrypt, argon2, Semgrep, OWASP ZAP, Snyk, Trivy, SBOM, container hardening, supply chain security, Cosign, SLSA, incident response, security posture, HashiCorp Vault, key management.

跳到安装查看文件

仓库: george11642/george-plugins
最近来源活动: 2026年3月11日 22:42
检测到的 SKILL.md 语言: 英语
星标: 2
Forks: 0

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 AI 助手安装

复制这段 Prompt，发给你正在使用的 AI 助手。

Follow https://skillsmp.com/skill-install/prompt.md to install only the Agent Skill at https://github.com/george11642/george-plugins/tree/main/plugins/george-setup/skills/security-deep.

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/george11642/george-plugins --skill security-deep

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

11 个文件

SKILL.md

来源说明 · 只读预览

name: security-deep
description: Use for security audits, vulnerability analysis, threat modeling, compliance, and incident response. Triggers on OWASP, XSS, SQL injection, CSRF, security audit, penetration testing, pen test, CVE, vulnerability, threat model, security review, SOC2, GDPR, PCI-DSS, HIPAA, compliance audit, CSP headers, HSTS, CORS policy, RBAC, ABAC, key rotation, encryption, AES-256, TLS, mTLS, bcrypt, argon2, Semgrep, OWASP ZAP, Snyk, Trivy, SBOM, container hardening, supply chain security, Cosign, SLSA, incident response, security posture, HashiCorp Vault, key management.

# Application Security (Deep) Deep security skill for architecture-level security decisions: auth design, cryptography, compliance, tooling, and incident response. Basic security checks (parameterized queries, no hardcoded secrets, input validation) belong in convention-check hooks -- this skill covers the WHY and HOW of security engineering. ## Task Router | Task | Reference | |------|-----------| | OWASP Top 10, injection, broken auth, crypto failures | [references/owasp-top10.md](references/owasp-top10.md) | | JWT, OAuth2/OIDC, session mgmt, RBAC/ABAC, MFA | [references/authentication-authorization.md](references/authentication-authorization.md) | | AES-GCM, RSA, TLS config, Vault, key lifecycle | [references/cryptography-secrets.md](references/cryptography-secrets.md) | | Input validation, SQLi, XSS, CSRF, SSRF, file upload | [references/secure-coding-patterns.md](references/secure-coding-patterns.md) | | Semgrep, Bandit, ESLint security, ZAP, Snyk, Trivy | [references/sast-dast-tools.md](references/sast-dast-tools.md) | | CSP, HSTS, CORS, cookie flags, rate limiting | [references/security-headers-hardening.md](references/security-headers-hardening.md) | | API auth, rate limiting, GraphQL, gRPC, error leakage | [references/api-security.md](references/api-security.md) | | SOC2, GDPR, PCI-DSS, HIPAA, ISO 27001 | [references/compliance-frameworks.md](references/compliance-frameworks.md) | | Credential leak, data breach, RCE, CVE, post-mortem | [references/incident-response.md](references/incident-response.md) | | Container hardening, Cosign, SLSA, SBOM, supply chain | [references/container-supply-chain.md](references/container-supply-chain.md) | ## When to Use This Skill - Designing auth/authz architecture for a new system - Choosing encryption algorithms or key management strategy - Setting up SAST/DAST pipeline in CI/CD - Preparing for SOC2/GDPR/PCI-DSS compliance audit - Responding to a security incident or CVE - Hardening container images and supply chain - Reviewing API security posture - Threat modeling a new feature ## Core Principles 1. **Defense in depth** -- layer multiple independent controls; never rely on one 2. **Least privilege** -- minimum permissions for every component 3. **Fail securely** -- deny access on error, not grant it 4. **Assume breach** -- design for detection and containment, not just prevention 5. **Security by default** -- secure config is the default; developers opt OUT, not IN 6. **Complete mediation** -- check authorization on every access, not just login ## CVSS Severity Quick Reference | Score | Severity | Patch SLA | Examples | |-------|----------|-----------|---------| | 9.0-10.0 | Critical | 24h (4h if exploited) | RCE, SQLi with full DB access, auth bypass | | 7.0-8.9 | High | 7 days | Stored XSS, privilege escalation, SSRF | | 4.0-6.9 | Medium | 30 days | Reflected XSS, CSRF, info disclosure | | 0.1-3.9 | Low | 90 days | Open redirect, verbose errors | ## Layer 3 Skills - **auth-clerk** — Clerk authentication and authorization setup - **monitoring-sentry** — Security incident monitoring via Sentry

在 GitHub 查看

返回搜索返回安装

fpga

Master FPGA skill covering Vivado, SystemVerilog/Verilog/VHDL, RTL design, timing closure, CDC, AXI interfaces, FSMs, pipelines, memory interfaces, HLS, verification, and hardware optimization. Uses Context7 MCP for up-to-date library docs. Use when FPGA, Verilog, VHDL, HDL, RTL, synthesis, or hardware design mentioned.

2026-03-24

analytics-posthog

Use when setting up PostHog analytics, feature flags, experiments, or querying PostHog data. Triggers on PostHog, PostHog event, PostHog feature flag, PostHog experiment, A/B test PostHog, HogQL, PostHog funnel, PostHog dashboard, PostHog LLM cost, posthog.capture, isFeatureEnabled, PostHog MCP, PostHog survey, PostHog error tracking.

2026-03-11

auth-clerk

Use when setting up Clerk authentication, configuring auth middleware, protecting routes, or handling Clerk webhooks. Triggers on Clerk, Clerk auth, ClerkProvider, auth middleware, protected routes, Clerk webhook, Svix, sign-in, sign-up, Clerk token, getToken, Clerk secret key, publishable key, Clerk setup, CAPTCHA signup, Clerk Next.js, Clerk React, Clerk Expo, user.created event, session management, Clerk identity.

2026-03-11

查看这个仓库的全部 Skills

security-deep

来源信息

安装方式

用 AI 助手安装

检查来源文件

同仓库更多 Skills

用 AI 助手安装

同仓库更多 Skills