菜单
A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-review |
| description | A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades. |
| allowed-tools | ["Read","Grep","Glob","Bash"] |
This skill should only use read-only commands and avoid modifying files.
Copy this checklist and use it to track your progress through a security review:
Security Review Checklist
- [ ] Scope the Change
- [ ] Identify entry points, data flows, and trust boundaries.
- [ ] Note any changes to auth, secrets, or external integrations.
- [ ] Threat Model
- [ ] Enumerate likely threats (STRIDE or similar).
- [ ] Focus on inputs, storage, and outputs.
- [ ] Validate Input & Output
- [ ] Validate and sanitize user-controlled input.
- [ ] Encode outputs to prevent injection.
- [ ] Constrain file paths and URLs (avoid traversal/SSRF).
- [ ] AuthN/AuthZ
- [ ] Authentication checks are present and consistent.
- [ ] Authorization rules are explicit and least-privilege.
- [ ] Session/token handling uses secure defaults.
- [ ] Secrets & PII
- [ ] No hardcoded secrets or credentials.
- [ ] Logs avoid sensitive data.
- [ ] Storage and transport are protected.
- [ ] Dependency Risk
- [ ] New dependencies are minimal and justified.
- [ ] Lockfiles updated and reviewed.
- [ ] Verification
- [ ] Add or update tests for security-sensitive behavior.
- [ ] Confirm error handling does not leak data.
When issues are found, propose the smallest safe change that addresses the risk, then add or update tests to prevent regressions.
Design robust backend systems and APIs. Use when users ask to plan or implement services, data models, or integrations.
Create distinctive, production-grade frontend interfaces with high design quality. Use when users ask to build web components, pages, or applications.
A specialist skill that recognises and applies common software architecture patterns within a codebase. This skill should be used during the design and development phases of a project.
A skill that outlines best practices for using Git in a collaborative development environment, including branching strategies, commit conventions, and pull request workflows.
Analyses and optimises performance across frontend, backend and database interactions. Identifies bottlenecks and implements solutions to enhance speed and efficiency.
A specialist skill that analyses a codebase to understand its structure, dependencies, and architecture. This skill should be used at the start of a new project or when onboarding to an existing codebase.