菜单
Phase 3 of security audit pipeline. Writes a failing test that reproduces the top vulnerability from the ranked backlog. Invoke with '/3-security-spec' after Phase 2 is complete. Do NOT fix code — just write the test.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/opsMachine/OM-Agency --skill 3-security-spec命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Performs comprehensive, brutally honest full-codebase review as a grumpy but fair senior developer with 20+ years of experience. Use when the user asks for a grumpy dev code review, brutal code review, senior dev review, comprehensive codebase audit, hall-of-shame code smells, or a gut-check on the entire project (not just a PR diff).
Diagnose and fix OneCLI gateway issues — Docker not running, 407 proxy auth, 401 from API (MITM not active), stale aoc_ token, CA cert refresh, secret setup, version pinning. Use when onecliStart fails, update-fathom-db fails, proxy returns 407 or 401, mode=tunnel in logs, or after OneCLI container recreation.
ANY CRM or progress.md write, log call, add contact, pipeline lookup, paste transcript/email. Runs lifecycle routing in Step 0 — delivery work goes to progress.md not Won CRM Next Action. Query before create. For week view use week-scan not this skill. OM-Repo SKILLS-MAP.md.
正在显示 SKILL.md
基于 SOC 职业分类
| name | 3-security-spec |
| description | Phase 3 of security audit pipeline. Writes a failing test that reproduces the top vulnerability from the ranked backlog. Invoke with '/3-security-spec' after Phase 2 is complete. Do NOT fix code — just write the test. |
| contract | {"tags":["security","audit","security-phase-3","tdd"],"state_source":"security_plan","inputs":{"params":[],"gates":[{"field":"backlog","value":"Ranked"}]},"outputs":{"mutates":[{"field":"current_item.test","sets_to":"Written"}],"side_effects":["Creates test file"]},"next":["4-security-fix"],"human_gate":false} |
Write a failing test that proves the top vulnerability exists. This is the red phase — do not touch the application code.
Read SECURITY_PLAN.md. Pick the top Pending (not DONE) item from the ranked backlog.
Write a test that reproduces the vulnerability.
tests/security/exploit_repro.test.ts)Run the test. Confirm it fails for the right reason (the vulnerability, not a syntax error).
Stop. Report the test file path and what it proves.
The next step is Phase 4: /4-security-fix