菜单
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | security-review |
| description | Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. |
Ensures all code follows security best practices and identifies potential vulnerabilities.
// NEVER: Hardcoded secrets
const apiKey = "sk-xxxxx"
const dbPassword = "password123"
// ALWAYS: Environment variables with validation
function requireEnv(name: string): string {
const value = process.env[name]
if (value == null) {
throw new Error(`Missing required environment variable: ${name}`)
}
return value
}
const apiKey = requireEnv('API_KEY')
const dbUrl = requireEnv('DATABASE_URL')
Verification:
.env.local in .gitignoreimport { z } from 'zod'
const CreateUserSchema = z.object({
email: z.string().email(),
name: z.string().min(1).max(100),
age: z.number().int().min(0).max(150)
})
export async function createUser(input: unknown) {
const validated = CreateUserSchema.parse(input)
return await db.users.create(validated)
}
File Upload Validation:
function validateFileUpload(file: File) {
const MAX_SIZE = 5 * 1024 * 1024 // 5MB
if (file.size > MAX_SIZE) {
throw new Error('File too large (max 5MB)')
}
const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/webp']
if (!ALLOWED_TYPES.includes(file.type)) {
throw new Error('Invalid file type')
}
return true
}
Verification:
// NEVER: String concatenation
const query = `SELECT * FROM users WHERE email = '${userEmail}'`
// ALWAYS: Parameterized queries
const user = await db.query(
'SELECT * FROM users WHERE email = $1',
[userEmail]
)
// Or with ORM/query builder
const user = await db.users.findFirst({
where: { email: userEmail }
})
// Token storage: httpOnly cookies, not localStorage
res.setHeader('Set-Cookie',
`token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`)
// Authorization: verify on every protected route
export async function DELETE(req: Request) {
const user = await requireAuth(req)
if (user.id !== targetUserId && user.role !== 'admin') {
return Response.json({ error: 'Forbidden' }, { status: 403 })
}
// Proceed
}
Verification:
// NEVER: Direct HTML injection
element.innerHTML = userInput
// ALWAYS: Text content or sanitization
element.textContent = userInput
// If HTML is needed:
import DOMPurify from 'dompurify'
element.innerHTML = DOMPurify.sanitize(userInput, {
ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'p'],
ALLOWED_ATTR: []
})
CSP Headers:
const securityHeaders = [
{
key: 'Content-Security-Policy',
value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;"
}
]
// SameSite cookies
res.setHeader('Set-Cookie',
`session=${sessionId}; HttpOnly; Secure; SameSite=Strict`)
// CSRF token verification
export async function POST(req: Request) {
const token = req.headers.get('X-CSRF-Token')
if (!csrfService.verify(token)) {
return Response.json({ error: 'Invalid CSRF token' }, { status: 403 })
}
// Proceed
}
import rateLimit from 'express-rate-limit'
// General API rate limit
const apiLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100,
message: 'Too many requests'
})
// Stricter limit for expensive operations
const searchLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: 10,
message: 'Too many search requests'
})
// NEVER: Log sensitive data
console.log('Login:', { email, password })
console.log('Payment:', { cardNumber, cvv })
// ALWAYS: Redact sensitive fields
console.log('Login:', { email, userId })
console.log('Payment:', { last4: card.last4, userId })
// NEVER: Expose internal errors
catch (error) {
return Response.json({ error: error.message, stack: error.stack })
}
// ALWAYS: Generic error messages
catch (error) {
console.error('Internal error:', error)
return Response.json({ error: 'An error occurred' }, { status: 500 })
}
npm audit # Check for vulnerabilities
npm audit fix # Fix automatically
npm outdated # Check for updates
npm ci # Reproducible installs in CI
test('requires authentication', async () => {
const response = await fetch('/api/protected')
expect(response.status).toBe(401)
})
test('requires admin role', async () => {
const response = await fetch('/api/admin', {
headers: { Authorization: `Bearer ${userToken}` }
})
expect(response.status).toBe(403)
})
test('rejects invalid input', async () => {
const response = await fetch('/api/users', {
method: 'POST',
body: JSON.stringify({ email: 'not-an-email' })
})
expect(response.status).toBe(400)
})
test('enforces rate limits', async () => {
const requests = Array(101).fill(null).map(() => fetch('/api/endpoint'))
const responses = await Promise.all(requests)
const rateLimited = responses.filter(r => r.status === 429)
expect(rateLimited.length).toBeGreaterThan(0)
})