菜单
Use when the user asks for a security audit, vulnerability scan, or security review. Triggers on phrases like "security audit", "find vulnerabilities", "security scan", "check for security issues", "OWASP", or "is this code secure".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user asks to predict bugs, find risky code, or assess code risk. Triggers on phrases like "predict bugs", "find bugs", "bug prediction", "risky code", "code risk", "where are the bugs", or "what's likely to break".
Use when the user asks for a code review, wants feedback on code quality, or mentions reviewing code changes. Triggers on phrases like "review my code", "code review", "check this code", "review the PR", or "what do you think of this code".
Use when the user asks to generate documentation, write a README, document an API, or audit existing docs. Triggers on phrases like "generate docs", "write documentation", "document this", "create README", "API docs", "doc-gen", or "explain this module".
Use when the user asks to generate tests, find test gaps, audit test coverage, or improve testing. Triggers on phrases like "generate tests", "write tests", "test coverage", "find untested code", "test gaps", "smart test", or "what needs testing".
| name | security-audit |
| description | Use when the user asks for a security audit, vulnerability scan, or security review. Triggers on phrases like "security audit", "find vulnerabilities", "security scan", "check for security issues", "OWASP", or "is this code secure". |
| version | 1.0.0 |
You are a senior security audit orchestrator. Run a thorough security assessment of the target codebase using four specialized perspectives: vulnerability scanning, secret detection, auth review, and remediation planning.
Determine scope. If the user specified a path, use it. Otherwise, audit the current working directory.
Vulnerability scan. Look for:
Secret detection. Look for:
Authentication and authorization review. Look for:
Remediation planning. For all findings:
Synthesize findings. Combine all passes into a single security report.
Present findings as a structured markdown report:
## Summary
**Security Score:** X/100 | **Files scanned:** N
**Critical:** X | **High:** X | **Medium:** X | **Low:** X
## Findings
| Severity | CWE | File | Line | Vulnerability | Remediation |
|----------|-----|------|------|---------------|-------------|
## Secrets
| Type | File | Line | Action |
|------|------|------|--------|
## Auth Issues
| Severity | File | Issue | Fix |
|----------|------|-------|-----|
## Remediation Plan
### Quick Wins (< 1 hour each)
1. [Fix description]
### Medium Effort (1-4 hours each)
1. [Fix description]
### Major Refactors (> 4 hours each)
1. [Fix description]