菜单
SCAFFOLDED. Phase 4 copies the validated skill manifest from Mac. Content is byte-identical across platforms. Do not adopt until Phase 4 validates skill loading in Claude Code on Windows.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Pre-generation security guidance for AI-generated code. Loads anti-pattern context on demand based on file type. Use whenever writing or editing source code, especially in Python, JavaScript, TypeScript, Go, Bash, Terraform, or SQL. The skill flags high-frequency vulnerability patterns before they ship: dependency risks (slopsquatting and confusion), cross-site scripting, hardcoded secrets, SQL injection, authentication failures, input validation gaps, command injection, missing rate limiting, data exposure through verbose errors or logs, and unsafe file upload handling.
Use when about to register a new MCP server, add to mcpServers, or accept an MCP invocation from a cloned repo. Walks the pre-trust audit (license, source review, network egress, version pin, secret-handling) before the server reaches the tool pool. Closes the gap above ~/.claude/mcp.json that the SessionStart hook does not gate.
Use when asked whether to adopt a tool, library, plugin, skill collection, agent definition, hook library, or any external project as part of the Claude Code harness. Applies the foundation/03 two-stage methodology (pre-filter then deep-eval), produces a binary integrate / integrate-with-constraints / reject decision, and prevents evaluation theater by rejecting rubric scoring.
| name | security-review |
| description | SCAFFOLDED. Phase 4 copies the validated skill manifest from Mac. Content is byte-identical across platforms. Do not adopt until Phase 4 validates skill loading in Claude Code on Windows. |
Phase 4 replaces this scaffold with the validated content copied from mac/harness/skills/security-review/SKILL.md. Skill is Layer 1 of the three-layer security stack and is content-identical across all three platforms.
See Mac equivalent for production content.
