菜单
Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jessedegans/jstack --skill security命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use before claiming work is done, before committing, before creating PRs, or before saying "it should work now." Enforces running verification commands and reading their output before making any completion claims. Evidence before assertions.
Record Architecture Decision Records (ADRs) when significant technical decisions are made. MUST trigger when switching, migrating, or replacing libraries, SDKs, frameworks, databases, or infrastructure. MUST trigger when making decisions that shape how the system works going forward: deployment strategies, service boundaries, data flow patterns, auth models, API design. Also trigger when choosing between alternatives, making trade-offs, or changing a previous approach. Common signals: "let's go with X", "we should use Y", "I've decided to", "switching from X to Y", "the trade-off is", "pros and cons of", "why did we choose X?", or "document this decision". Even if the user doesn't say "ADR", if a decision is being made that future-them would want to remember the reasoning for, this skill applies. Record the ADR proactively, don't wait to be asked.
Use before starting any feature, entering unfamiliar code, or beginning a non-trivial task. Enforces understanding before action. No code, no scaffolding, no implementation until the problem is explored and a direction is approved. Use when: user says "let's build X", "add feature Y", "I want to create Z", or begins work on something that needs design thinking.
基于 SOC 职业分类
正在显示 SKILL.md
| name | security |
| description | Use when reviewing code for security vulnerabilities, before shipping to production, or when the user asks for a security audit. Runs OWASP Top 10 + STRIDE analysis with a strict false positive filter. Confidence gate at 8/10. No theoretical hand-waving. |
| version | 1.0.0 |
For each entry point, check:
| Category | Look for |
|---|---|
| A01 Broken Access Control | Missing auth checks, direct object references, path traversal |
| A02 Crypto Failures | Weak algorithms, hardcoded secrets, plaintext storage |
| A03 Injection | SQL, command, template, LLM prompt injection |
| A04 Insecure Design | Business logic flaws, missing rate limits |
| A05 Misconfiguration | Debug mode, default creds, overly permissive CORS |
| A06 Vulnerable Components | Outdated deps with known CVEs |
| A07 Auth Failures | Weak passwords, missing MFA, session fixation |
| A08 Integrity Failures | Unsigned updates, untrusted CI/CD inputs |
| A09 Logging Gaps | Missing audit trail, logging sensitive data |
| A10 SSRF | User-controlled URLs fetched server-side |
For each significant component: can an attacker achieve Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, or Elevation of Privilege?
Tag all stored/transmitted data as:
Hard exclusions, don't report these:
Precedents, assume these are fine unless proven otherwise:
