菜单
Defensive application security for PHP/web services — secure coding review, input validation, authn/authz, session/token security, injection/XSS/CSRF/SSRF/IDOR/deserialization defenses, secrets, and crypto. Use for security reviews and security-sensitive design. Defensive use only.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Apache2 (httpd) configuration and ops for PHP services — vhosts, MPM tuning, PHP-FPM via mod_proxy_fcgi, mod_rewrite, TLS/HTTP2, compression/caching, hardening, and diagnosing 5xx/perf issues. Use for web-server config, deployment topology, and Apache performance/security.
Test automation strategy and engineering across the pyramid — unit, integration, API/contract, and end-to-end. Use for designing a test strategy, building API/E2E suites, CI test pipelines, fixtures/factories, flake reduction, and coverage of a REST microservice. Complements phpunit-testing for cross-cutting and higher-level testing.
MySQL schema design, indexing, and query tuning. Use when modeling tables, choosing types/keys, writing or optimizing SQL, reading EXPLAIN output, or resolving slow queries, deadlocks, and transaction issues.
Modern PHP 8.4/8.5 authoring and review. Use when writing idiomatic typed PHP, applying new language features, migrating older code, or resolving type/strictness issues. State the minimum PHP version any recent feature requires.
PHP performance — profiling, removing hotspots, cutting latency/memory, OPcache/JIT/preloading, eliminating N+1, efficient structures, generators/streaming, connection reuse, benchmarking. Use when something is slow or memory-heavy, or to validate an optimization. Measure first.
Redis from PHP — caching, sessions, rate limiting, locks, queues/streams, pub/sub, sorted-set patterns, TTL/eviction. Use when adding Redis to a feature, designing key schemes, or fixing cache correctness/stampede issues.
| name | php-security-engineer |
| description | Defensive application security for PHP/web services — secure coding review, input validation, authn/authz, session/token security, injection/XSS/CSRF/SSRF/IDOR/deserialization defenses, secrets, and crypto. Use for security reviews and security-sensitive design. Defensive use only. |
Review/design against OWASP Top 10 and ASVS. Defensive work only — no attack tooling for unauthorized targets.
emulate_prepares off; never string-build SQL. Allow-list anything unparameterizable (identifiers, ORDER BY).password_hash/password_verify (current default algo); hash_equals for token compares.HttpOnly+Secure+SameSite; regenerate ID on privilege change; short-lived, scoped, rotated bearer tokens. CSRF protection for state-changing browser requests.unserialize() untrusted input. Guard SSRF (allow-list outbound hosts).random_bytes, AEAD encryption. Never roll your own.X-Content-Type-Options, strict CORS (no wildcard with credentials).composer audit, pin and minimize deps.Per finding: severity, vulnerable code path, concrete exploit scenario, exact remediation. Verify against the actual code. For deeper threat modeling, use the cybersecurity-analyst skill.