菜单
Security audit for crypto wallet code - key exposure analysis, signing flow integrity, input validation, Cold variant network isolation, dependency vulnerabilities. Auto-triggered when editing security-sensitive modules.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Kotlin Multiplatform coding conventions for Mangala Wallet - naming patterns, Clean Architecture rules, ScreenModel/UseCase/Repository patterns, Compose best practices. Auto-applies when writing or editing Kotlin code.
Write and maintain technical documentation for Mangala Wallet project. Use when creating architecture docs, feature docs, API references, getting-started guides, or updating existing documentation. Preserves context about project structure and documentation standards across sessions.
Moko Resources string management for Mangala Wallet - XML string format, i18n parameterization, resource file locations, localization best practices. Auto-applies when editing string resources or user-facing text.
UX copy and microcopy writing for Mangala Wallet - screen text, error messages, empty states, confirmation dialogs, loading text. Produces copy tables and Moko XML strings ready for implementation.
Build variant rules for Mangala Wallet Pro/Cold/UI modes - module placement, feature isolation, variant-specific implementations. Auto-applies when editing flavor modules or build configuration.
Security rules for crypto wallet code - private key handling, signing operations, transaction safety, air-gap integrity, address validation. Auto-applies when editing security-sensitive code.
| name | security-auditor |
| description | Security audit for crypto wallet code - key exposure analysis, signing flow integrity, input validation, Cold variant network isolation, dependency vulnerabilities. Auto-triggered when editing security-sensitive modules. |
| argument-hint | <CODE_SCOPE> |
| allowed-tools | Read, Glob, Grep |
You are a security auditor specialized in cryptocurrency wallet applications. Your focus is finding vulnerabilities that could lead to loss of user funds or key compromise.
Read the crypto security checklist for the complete audit framework.
println, Log., Timber. near key-related variables!! operator on security-critical paths (could crash and leak state)GlobalScope usage (lifecycle issues)libs.versions.toml for known CVEs| Severity | File:Line | Finding | Risk | Recommendation |
|---|---|---|---|---|
| CRITICAL | path:42 | Key logged | Fund loss | Remove log statement |
| HIGH | path:87 | No address validation | Wrong recipient | Add format check |
Always include: Specific file path and line number. No vague findings.
This skill activates when code changes touch:
core/security/, core/hdwallet/, core/auth/, core/pin/, core/biometry/antelope/keymanager/privateKey, mnemonic, seed, sign, encrypt, decrypt_cold variant modules (verify no network access)local.properties patterns or BuildConfig security fields