菜单
Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Stop AI coding agents from shipping sloppy code — over-abstraction, drive-by refactors, obvious comments, extra files, unrequested deps, giant unreadable files, or fishing outside the workspace for “inspiration”. Use when writing or editing code, implementing features, fixing bugs, splitting or organizing files, or when the user mentions slop, cleanup, keep it simple, minimal diff, file too big, hard to navigate, or stay in the repo.
Make PRs merge-ready — tight scope, clear description, no leftover debug, honest test notes. Use when opening a PR, writing a PR description, cleaning a branch before review, or when the user mentions pull request, merge-ready, or PR hygiene.
基于 SOC 职业分类
| name | security-review |
| description | Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check. |
Review the current change like a security-minded senior. Prefer concrete findings over generic advice.
Focus on the diff and directly related call paths. Do not audit the whole repo unless asked.
userId in body ≠ proof)../)HttpOnly, Secure, SameSite where applicableeval, dangerouslySetInnerHTML, shell exec with unsanitized inputGroup findings:
| Severity | Rule | Where | Why it matters | Fix |
|---|---|---|---|---|
| Critical / High / Medium / Low / Note | short name | file:line or symbol | 1 sentence | concrete change |
End with:
If no issues: say so explicitly and list what you checked.