菜单
Phoenix auth/session/CSRF, command authorization, event data sensitivity, Postgres, dependency, secret, and threat-model review triggers.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Fine-grained outside-in RED-GREEN-REFACTOR microcycles with specialist agents and single-diagnostic implementation.
RGR sequence, observed-failure evidence, drill-down unit tests, and non-behavioral exemptions for Phoenix/Commanded work.
Phoenix 1.8, Postgres, Commanded, Ecto, ExUnit, Dialyzer, and strict static-check conventions.
Process Forgejo PR feedback with reflection, guardrail-gap classification, and inline thread replies.
Classify review feedback and choose proportionate guardrails without inflating default context cost.
Write implementation plans as test-addressed red-green-refactor cycles rather than component waterfalls.
| name | security-threat-model |
| description | Phoenix auth/session/CSRF, command authorization, event data sensitivity, Postgres, dependency, secret, and threat-model review triggers. |
Use this skill when changes touch Phoenix auth, sessions, CSRF, LiveView, command authorization, event payload PII, Postgres access, webhooks, background jobs, secrets, dependencies, or deployment.
Read docs/THREAT-MODEL.md and the relevant ADRs before changing security-sensitive behavior when those files exist. If the change introduces a new threat boundary and no threat model exists yet, call that out explicitly.
If a documented threat changes, update the matching security test when needed. Deployment, telemetry, or alerting changes may require updates to operations docs and monitoring contracts.
