菜单
Use when auditing a codebase before it goes public-facing, after a lab build, or on any periodic security pass. Checks secrets in code and history (including Claude Code transcripts), authorization and RLS, input validation, dependency red flags, and exposed endpoints.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when a question has a factual or best-practice answer but a single response might hallucinate, or when the user asks to "get consensus" or "sanity check this with multiple agents". Spawns N subagents on the same question with varied personas and tallies answer frequency.
Use when a question has real trade-offs and no single right answer: architecture choices, library selection, design direction. Runs a multi-round debate where agents see each other's positions across rounds, converge, and a synthesis is produced. For factual questions, use consensus instead.
Use when triaging an inbox: fetching unprocessed emails, classifying each into a label taxonomy, and applying labels via the provider's API. Provider-agnostic skeleton; scripts/label.py must be wired to your email provider before first use.
Use when a workflow built on an MCP server has stabilized and should become a production skill, or when the user says "convert this MCP workflow to a skill". Produces a skill with a bundled script that calls the underlying API directly, eliminating the per-session MCP token overhead.
Use when a PRD or spec exists and needs to become an executable backlog. Breaks the document into GitHub issues structured as vertical-slice tracer bullets, marks each as HITL or AFK, and files a final QA issue. Requires the gh CLI.
Use when implementing any task that should end in a commit. Encodes the definition of done: understand, implement with red-green-refactor for backend logic, run typecheck and tests until clean, then commit. Also the unit of work for autonomous loops.
| name | security-audit |
| description | Use when auditing a codebase before it goes public-facing, after a lab build, or on any periodic security pass. Checks secrets in code and history (including Claude Code transcripts), authorization and RLS, input validation, dependency red flags, and exposed endpoints. |
Run this in a FRESH session. An auditor that helped write the code shares its blind spots. Zero context is the feature: /clear first, or open a new session, then invoke this skill.
Work through all five fronts. For each finding report: severity (critical/high/medium/low), file and line, the attack it enables, and the fix. No hand-waving; every finding gets a concrete fix.
sk-, sk_live, AKIA, ghp_, -----BEGIN, password\s*=, token\s*= with literal values.git log -p | grep for the same patterns. A key deleted in a later commit is still leaked..env is gitignored and no .env* file is tracked.~/.claude session JSONL files forever. Search them: grep -rl "sk-\|sk_live\|AKIA" ~/.claude/projects/ 2>/dev/null. If keys appear, instruct the user to rotate them. Deleting the transcript does not unleak a key.pnpm audit, pip-audit) and triage criticals./dev/* prototypes, and webhook endpoints without signature verification all count as findings.A findings table sorted by severity, then a "fix now" list of the top 3. Offer to fix the top finding immediately.