菜单
Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-audit |
| description | Run a project-specific security audit of this Express API — auth, CSRF, rate limiting, headers, validation, secrets, and dependencies. Use when the user asks for a security review, audit, hardening pass, or before a release. |
Audit the codebase against this project's security architecture. Report findings ordered by severity with file:line references; do not change code unless asked.
src/services/auth.service.ts, cookie options in the auth controller). Flag any token exposed in a JSON body or non-HttpOnly cookie.httpOnly: true, secure in production, sameSite set, correct maxAge matching token expiry.protect middleware (src/middleware/auth.middleware.ts) applied to every non-public route; 401 for unauthenticated, 403 for authenticated-but-forbidden.userId).doubleCsrfProtection applied to all mutating routes (POST/PUT/PATCH/DELETE) in every file in src/routes/.GET /auth/csrf-token must not itself be state-changing.src/middleware/limiter.middleware.ts; auth routes must have the strictest limit.helmet and CORS configured in src/app.ts; CORS origin must come from config, never * with credentials.trust proxy set correctly so limiters key on the real client IP.src/validations/.toResponseDTO() — flag any handler returning a raw Prisma entity (risk: leaking password, token hashes, internal fields).src/errors/ + global error middleware; flag any res.status().json() on an error path (risk: inconsistent shape, stack leaks). Error middleware must not expose stack traces or Prisma error details in production.process.env outside src/config/env.ts; all secrets validated by the Zod env schema with no insecure defaults for JWT_SECRET/cookie secrets..env gitignored; .env.example contains placeholders only. Scan the repo for hardcoded credentials, API keys, or connection strings.src/config/logger.ts) redacts sensitive fields (authorization headers, cookies, passwords).pnpm audit --prod
.github/workflows/ and passing.For each finding: severity (critical/high/medium/low) — title — file:line — why it matters — recommended fix. End with a short summary of what was checked and found clean.
Add a new Express middleware to this project and wire it up correctly. Use when the user asks to add middleware — rate limiting, request guards, validation, logging enrichment, custom auth checks, etc.
Add or update OpenAPI 3.1 documentation for API endpoints in src/docs/. Use when the user asks to document endpoints, add Swagger/OpenAPI docs, or when a new resource or route was added without docs.
Scaffold unit and integration tests for an existing resource or service. Use when the user asks to add tests, write tests, or improve test coverage for a specific resource, service, controller, or route.
Scaffold a complete new API resource (validation → repository → service → controller → route → container → app mount → OpenAPI → tests). Use when the user asks to add a new resource, entity, model, or endpoint group to the API.
Update the Prisma schema to add a new model, add fields to an existing model, or change relations — then run migration and regenerate the client. Use when the user asks to add a field, add a model, change a relation, or update the database schema.