菜单
Comprehensive security audit checklist with tech-specific items. Used by Security Reviewer during /implement and /design phases. Covers auth, input validation, data protection, API, secrets, dependencies, logging, payments, health data, infrastructure.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Test design techniques reference — Equivalence Partitioning (EP), Boundary Value Analysis (BVA), Decision Table Testing, State Transition Testing, Pairwise Testing, Error Guessing, Checklist-based Testing. Used by QA Engineer agent to generate structured, coverage-driven checklists from feature descriptions.
PM frameworks for task refinement — story formats (User Story, Job Story, WWA), INVEST criteria, T-shirt sizing, clarifying question patterns, risk flags. Used by Task Refiner agent during /refine.
Template for Architecture Decision Records (ADR). Used by Design Architect during /design phase. Always one file per decision in adr/ directory.
Write API documentation compatible with Stoplight platform. Use when the user asks to "write API docs", "create Stoplight documentation", "document API endpoints", "write OpenAPI description", mentions "Stoplight", "SMD", "Stoplight Flavored Markdown", or needs API reference docs, guides, tutorials, or articles for a Stoplight-hosted documentation project.
Template for API contract documentation — REST endpoints and async message contracts. Used by Design Architect during /design phase.
Template for architecture design artifacts — diagrams.md and architecture.md. Used by Design Architect agent during /design phase.
基于 SOC 职业分类
| name | security-audit-checklist |
| description | Comprehensive security audit checklist with tech-specific items. Used by Security Reviewer during /implement and /design phases. Covers auth, input validation, data protection, API, secrets, dependencies, logging, payments, health data, infrastructure. |
| version | 1.0.0 |
Comprehensive checklist for Security Reviewer agent. Use during code review to verify all security aspects. Select relevant sections based on changed files.
/implement phase (Phase 4 of review workflow)/design phase (optional security review)Do NOT check every item on every review. Select sections relevant to the changed files:
| Changed Files | Relevant Sections |
|---|---|
| New API endpoints | Authentication, API Security, Input Validation |
| Database/query changes | Input Validation (injection), Data Protection |
| Config/env changes | Secrets & Configuration |
| Payment/billing code | Financial Operations, Data Protection |
| Health/user data | Health Data, Data Protection, Logging |
| Dependency updates | Dependencies & Supply Chain |
| Auth code | Authentication, Logging |
| Infrastructure/deploy | Infrastructure & Deployment |
#[IsGranted] or $this->denyAccessUnlessGranted() on endpoints%kernel.secret%secure, httpOnly, sameSite flagsParamConverter for type-safe route parameters|raw filter used only with sanitized contentexpress.json({ limit: '100kb' }) configuredinnerHTML never used with user contentAccess-Control-Allow-Origin: * for authenticated APIs)git log -S "password").env files in .gitignore.env.example has placeholder values onlycomposer audit / npm audit / govulncheck)SELECT FOR UPDATE)| Pattern | Problem | Fix |
|---|---|---|
| Check everything | Reviewing all 80+ items on a 3-file change | Use "How to Use" table to select relevant sections |
| Blind pass | Marking items as checked without reading code | Each checked item should reference the file/line verified |
| Missing tech-specific | Checking generic items but skipping framework-specific | Always include tech-specific subsection for the project's stack |
| Domain blindness | Skipping Financial/Health sections on payment/health code | Match changed files to domain sections |
| Checklist as output | Dumping the entire checklist in the review report | Report only findings (failed items), not the full checklist |