菜单
A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Design robust backend systems and APIs. Use when users ask to plan or implement services, data models, or integrations.
Builds a fast feedback loop, reproduces the symptom, tests ranked hypotheses, instruments narrowly, fixes, and adds regression coverage. Use when the user says diagnose/debug, reports broken behaviour, failing checks, thrown errors, flaky bugs, or performance regressions.
Create distinctive, production-grade frontend interfaces with high design quality. Use when users ask to build web components, pages, or applications.
Stress-tests a plan against the existing domain language, code, and documented decisions, then updates CONTEXT.md or ADRs as decisions crystallise. Use when the user wants to be grilled on a design, validate a plan, sharpen terminology, or record the reasoning behind a decision.
Reviews a codebase for architectural friction and proposes deepening opportunities grounded in its domain language, tests, dependencies, and ADRs. Use when the user wants architecture review, refactoring candidates, better module shape, clearer seams, or a codebase that is easier to test and navigate.
Drives changes through a strict red-green-refactor loop using behaviour tests at the public interface. Use when the user asks for TDD, test-first development, integration tests, regression coverage, or a feature built one vertical slice at a time.
| name | security-review |
| description | A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades. |
This skill should only use read-only commands and avoid modifying files.
Copy this checklist and use it to track your progress through a security review:
Security Review Checklist
- [ ] Scope the Change
- [ ] Identify entry points, data flows, and trust boundaries.
- [ ] Note any changes to auth, secrets, or external integrations.
- [ ] Threat Model
- [ ] Enumerate likely threats (STRIDE or similar).
- [ ] Focus on inputs, storage, and outputs.
- [ ] Validate Input & Output
- [ ] Validate and sanitize user-controlled input.
- [ ] Encode outputs to prevent injection.
- [ ] Constrain file paths and URLs (avoid traversal/SSRF).
- [ ] AuthN/AuthZ
- [ ] Authentication checks are present and consistent.
- [ ] Authorization rules are explicit and least-privilege.
- [ ] Session/token handling uses secure defaults.
- [ ] Secrets & PII
- [ ] No hardcoded secrets or credentials.
- [ ] Logs avoid sensitive data.
- [ ] Storage and transport are protected.
- [ ] Dependency Risk
- [ ] New dependencies are minimal and justified.
- [ ] Lockfiles updated and reviewed.
- [ ] Verification
- [ ] Add or update tests for security-sensitive behavior.
- [ ] Confirm error handling does not leak data.
When issues are found, propose the smallest safe change that addresses the risk, then add or update tests to prevent regressions.