菜单
Repeatable process for an application security code review that produces prioritized findings and fix guidance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.
Triage a dependency CVE using local repo evidence and remediation guidance.
Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.
Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.
Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.
Review workflow for AI/LLM output usage to prevent over-trust, injection, and unsafe automation.
| name | secure-code-review |
| description | Repeatable process for an application security code review that produces prioritized findings and fix guidance. |
Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.
If this repo includes prompt files under /prompts, the following are commonly relevant:
secure-code-review.prompt.mdscan-for-insecure-apis.prompt.mdvalidate-input-handling.prompt.mdreview-auth-flows.prompt.md