菜单
Perform a security pass aligned with MediaJira standards (no secrets, auth/CORS, input validation, least privilege, credential handling). Use for pre-release checks or when touching auth/sensitive code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Implement a new backend API endpoint using the full chain (model, serializer, service, view, url, tests). Use when adding a new resource or action to an existing or new Django app.
Implement a new frontend page and wire it to the backend API (API client, types, route, components, navigation, tests). Use when adding a new screen or feature that talks to the API.
Run a code review against MediaJira standards (thin views/pages, API layer placement, no secrets, error handling, permissions, tests). Use before requesting review or merging.
Prepare a well-structured pull request with Conventional Commits, Jira key support, clear description, and pre-merge checks. Use when changes are ready for review.
Run the full test suite (backend pytest and frontend lint/test), then systematically fix any failures. Use when verifying changes or after pulling updates.
基于 SOC 职业分类
| name | security-audit |
| description | Perform a security pass aligned with MediaJira standards (no secrets, auth/CORS, input validation, least privilege, credential handling). Use for pre-release checks or when touching auth/sensitive code. |
.env, tokens, keys, or credentials are committed or logged. Search for accidental exposure of auth headers or sensitive data in logs.backend/backend/settings.py; no wildcards for production.Authorization: Bearer); components do not read or send tokens directly. API layer does not swallow errors; 401 handled by interceptor (clear storage, redirect to login).