菜单
Review code and architecture for security risks, then harden the implementation without unnecessary complexity. Use when: checking auth flows, input validation, secrets, dependency risk, unsafe file or network access, or preparing a project for release.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Clean up AI-generated or over-engineered code while preserving behavior. Use when: refactoring noisy code, removing dead code, simplifying abstractions, or making code more idiomatic without changing the public API.
Review AI-generated code changes for unintended consequences, logic errors, UI inconsistencies, and context-specific issues. Use when: code has just been modified, flag potential bugs, verify UI consistency, check implementation correctness against project patterns.
Turn a feature request, issue, or rough spec into a safe implementation plan for an existing codebase. Use when: planning a new feature, scoping impacted files, evaluating trade-offs, or deciding rollout steps before coding.
Turn small ideas into fully-fledged projects through structured discovery, research, and specification. Use when: starting a new project from a rough idea, need to validate feasibility, want to create comprehensive project documentation, exploring feature requirements and design patterns. Conversational, adaptive workflow.
Audit the quality and robustness of an implementation by inventorying the code, understanding how it works, then researching reference examples and community standards online to identify gaps. Use when: checking if a DSP routine is correct, validating a JUCE component follows best practices, reviewing an entire module for structural weaknesses, or verifying a feature is not just "working" but properly implemented.
Initialize or bootstrap a Ralph workspace. Use when starting a repo, preparing the workspace for first use, creating or seeding the `.ralph` folder, filling the first project understanding / journal entries, and documenting setup blockers before substantive work begins.
| name | security-and-hardening |
| description | Review code and architecture for security risks, then harden the implementation without unnecessary complexity. Use when: checking auth flows, input validation, secrets, dependency risk, unsafe file or network access, or preparing a project for release. |
| argument-hint | Describe the code, surface area, or threat concern to review |
| user-invocable | true |
| disable-model-invocation | false |
Start from trust boundaries, not just code snippets. Identify what inputs cross into the system, what privileged actions exist, where secrets live, and which failures could expose data or control.
Focus on realistic risks and practical mitigations. The goal is to reduce exploitability and blast radius while keeping the codebase maintainable.
Use workflow.md for the full review flow and stack-specific checks.
Deliver a hardening report with:
/security-and-hardening -> "Review this auth flow for access-control mistakes"/security-and-hardening -> "Check this upload endpoint for common security issues"/security-and-hardening -> "Audit this JUCE preset-loading code for unsafe parsing or memory problems"See EXAMPLES.md for example security reviews, finding formats, and mitigation style.