菜单
This skill should be used when auditing code for security issues, reviewing authentication/authorization, evaluating input validation, analyzing cryptographic usage, or reviewing dependency security. Provides OWASP patterns, CWE analysis, and threat modeling guidance.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/outfitter-dev/outfitter --skill security命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Patterns for @outfitter/daemon including lifecycle management, IPC communication, health checks, and PID files. Use when building background services, daemons, or when "daemon", "IPC", "health check", "background service", or "@outfitter/daemon" are mentioned.
Creates handlers, CLI commands, MCP tools, and daemon services following Outfitter Dev Kit conventions. Use when adding new components to a project, scaffolding code, or when "create handler", "new command", "add tool", or "daemon service" are mentioned.
Deep patterns for @outfitter/mcp including tool registration, Zod schemas, resources, and server configuration. Use when building MCP servers, registering tools, defining resources, or when "MCP server", "MCP tool", "registerTool", or "@outfitter/mcp" are mentioned.
正在显示 SKILL.md
基于 SOC 职业分类
| name | security |
| description | This skill should be used when auditing code for security issues, reviewing authentication/authorization, evaluating input validation, analyzing cryptographic usage, or reviewing dependency security. Provides OWASP patterns, CWE analysis, and threat modeling guidance. |
| metadata | {"version":"1.0.1"} |
Threat-aware code review. Vulnerability detection. Risk-ranked remediation.
<when_to_use>
NOT for: performance optimization, general code review, feature implementation
</when_to_use>
Load the maintain-tasks skill for stage tracking. Each stage feeds the next.
| Stage | Trigger | activeForm |
|---|---|---|
| Threat Model | Session start | "Building threat model" |
| Attack Surface | Model complete | "Mapping attack surface" |
| Vulnerability Scan | Surface mapped | "Scanning for vulnerabilities" |
| Risk Assessment | Vulns identified | "Assessing risk levels" |
| Remediation Plan | Risks assessed | "Planning remediation" |
Critical findings: add urgent remediation task immediately.
<severity_levels>
CVSS-aligned severity for findings:
| Indicator | Severity | CVSS | Examples |
|---|---|---|---|
| Critical | 9.0-10.0 | RCE, auth bypass, mass data exposure, admin privesc | |
| High | 7.0-8.9 | SQLi, stored XSS, auth weakness, sensitive data leak | |
| Medium | 4.0-6.9 | CSRF, reflected XSS, info disclosure, weak crypto | |
| Low | 0.1-3.9 | Misconfig, missing headers, verbose errors |
Format: "Critical RCE via unsanitized shell command"
</severity_levels>
<threat_modeling>
Systematic threat identification by category:
| Threat | Question | Check |
|---|---|---|
| Spoofing | Can attacker impersonate? | Auth mechanisms, tokens, sessions, API keys |
| Tampering | Can attacker modify data? | Input validation, integrity checks, DB access |
| Repudiation | Can actions be denied? | Audit logs, signatures, timestamps |
| Info Disclosure | Can attacker access secrets? | Encryption, access control, logging |
| Denial of Service | Can attacker disrupt? | Rate limits, timeouts, input size |
| Elevation | Can attacker gain access? | Authz checks, RBAC, least privilege |
Map paths from attacker goal to entry points:
Goal: Steal credentials
- Attack login
- SQLi in username
- Brute force (no rate limit)
- Session fixation
- Intercept traffic
- HTTPS downgrade
- MITM
- Exploit reset
- Predictable token
- No expiry
For each branch assess: feasibility, impact, detection, current defenses.
Identify where data crosses trust levels:
Every boundary needs validation.
</threat_modeling>
<attack_surface>
External:
Data Inputs:
Auth Boundaries:
For each entry point document:
</attack_surface>
<vulnerability_patterns>
| Vulnerability | Vulnerable | Secure |
|---|---|---|
| SQL Injection | String concat in query | Parameterized queries |
| XSS | innerHTML with user data | textContent or DOMPurify |
| Command Injection | exec() with user input | execFile() with array |
| Path Traversal | Direct path concat | basename + prefix check |
| Weak Password | MD5/SHA1/plain | bcrypt (12+) or argon2 |
| Predictable Token | Math.random/Date.now | crypto.randomBytes(32) |
| Broken Auth | Client-side role check | Server-side every request |
| IDOR | No ownership check | Verify user owns resource |
| Hardcoded Secret | API key in code | Environment variable |
| Info Leak | Stack trace to user | Generic error, log detail |
Authentication:
Authorization:
Input Validation:
Cryptography:
See vulnerability-patterns.md for code examples.
</vulnerability_patterns>
<owasp_top_10>
2021 OWASP Top 10 categories. Check each during vulnerability scan.
| # | Category | Key CWEs | Top Mitigations |
|---|---|---|---|
| A01 | Broken Access Control | 200, 352, 639 | Server-side checks, ownership validation |
| A02 | Cryptographic Failures | 259, 327, 331 | TLS, bcrypt, no hardcoded secrets |
| A03 | Injection | 20, 79, 89 | Parameterized queries, input validation |
| A04 | Insecure Design | 209, 256, 434 | Threat modeling, rate limiting |
| A05 | Security Misconfiguration | 16, 611, 614 | Security headers, disable debug |
| A06 | Vulnerable Components | 1035, 1104 | npm audit, Dependabot |
| A07 | Auth Failures | 287, 307, 521 | Strong passwords, MFA, rate limiting |
| A08 | Integrity Failures | 502, 494 | Verify signatures, schema validation |
| A09 | Logging Failures | 117, 532, 778 | Audit logs, redact sensitive data |
| A10 | SSRF | 918 | URL allowlist, block private IPs |
See owasp-top-10.md for detailed breakdowns with code examples.
</owasp_top_10>
Loop: Model Threats -> Map Surface -> Scan Vulnerabilities -> Assess Risk -> Plan Remediation
Threat Model
Attack Surface
Vulnerability Scan
npm audit, cargo auditRisk Assessment
Remediation Plan
Update todos as you progress. Use review-checklist.md for verification.
## {SEVERITY} {VULN_NAME}
**Category**: {OWASP} | **CWE**: {ID} | **File**: {PATH}:{LINES}
### Issue
{CLEAR_EXPLANATION}
### Impact
{WHAT_ATTACKER_COULD_DO}
### Fix
{SPECIFIC_REMEDIATION_WITH_CODE}
# Security Audit: {SCOPE}
| Severity | Count |
| -------- | ----- |
| Critical | N |
| High | N |
| Medium | N |
| Low | N |
## Key Findings
1. {TOP_CRITICAL}
2. {SECOND}
3. {THIRD}
## Recommendations
- Immediate: {CRITICAL_FIXES}
- Short-term: {HIGH_MEDIUM}
- Long-term: {HARDENING}
See report-templates.md for full templates.
ALWAYS:
NEVER:
Deep dives:
Related skills:
External: