菜单
Comprehensive security audit of codebase using multiple security-auditor agents. Use before production deployments or after major features.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
End-of-session reflection. Extracts memories, suggests updates to about-taylor.md and CLAUDE.md. Run before ending a long session or when context is getting full. Triggers on "debrief", "extract memories", "session summary".
Sync all git repos - my-life top repo and spaces/ projects
Morning routine check-in. Use at start of day to review yesterday, set up today's journal, and check learning reviews due. Triggers on "good morning", "morning", "start my day", "what's on for today".
Silently refresh AI context by reading project configuration and guidelines. Use when starting a new conversation, after context loss, or before major tasks.
Fetch and summarize latest articles from RSS feeds. Creates notes with article summaries as bullet points. Use to catch up on blogs without reading everything. Triggers on "rss catchup", "blog catchup", "check feeds", "summarize articles".
Fetch and summarize latest videos from priority YouTube channels. Creates notes with transcripts summarized as bullet points. Use to catch up on subscriptions without watching everything. Triggers on "youtube catchup", "video catchup", "check youtube", "summarize videos".
| name | security-audit |
| description | Comprehensive security audit of codebase using multiple security-auditor agents. Use before production deployments or after major features. |
| model | claude-sonnet-4-20250514 |
| allowed-tools | Read, Write, Glob, Grep, Task |
Multi-agent security audit with findings saved to timestamped report.
/security-audit yourbench # Full security review
/security-audit coordinatr # Audit specific project
Five security-auditor agents run in parallel:
| Agent | Focus Area | Checks |
|---|---|---|
| Agent 1: Auth & Access | Authentication, Authorization | JWT handling, session management, RBAC, privilege escalation |
| Agent 2: Input & Data | Injection, Validation | SQL injection, XSS, command injection, input sanitization |
| Agent 3: Crypto & Secrets | Cryptography, Secrets | Hardcoded credentials, weak crypto, key management, PII |
| Agent 4: Config & Deploy | Configuration, Infrastructure | CORS, CSRF, security headers, exposed endpoints, debug mode |
| Agent 5: Dependencies | Supply Chain, Libraries | Vulnerable packages, outdated deps, license issues |
| OWASP Risk | Coverage |
|---|---|
| A01 Broken Access Control | Agent 1 |
| A02 Cryptographic Failures | Agent 3 |
| A03 Injection | Agent 2 |
| A04 Insecure Design | Agents 1, 4 |
| A05 Security Misconfiguration | Agent 4 |
| A06 Vulnerable Components | Agent 5 |
| A07 Auth Failures | Agent 1 |
| A08 Data Integrity Failures | Agents 2, 3 |
| A09 Logging Failures | Agent 4 |
| A10 SSRF | Agent 2 |
ls spaces/[project]/
5 security-auditor agents run concurrently with focused prompts.
Aggregate by:
Write: .claude/temp/security-audit-[project]-[timestamp].md
# Security Audit: [Project Name]
**Date**: YYYY-MM-DD HH:MM:SS
## Executive Summary
- Critical issues: X
- High severity: Y
- Total findings: Z
## Critical Issues
### [Issue Title]
- **Severity**: Critical
- **Category**: SQL Injection (CWE-89)
- **Location**: src/api/users.py:42
- **Description**: [What's wrong]
- **Impact**: [What could happen]
- **Remediation**: [How to fix]
## High Severity Issues
[...]
## Recommendations
- Priority actions
- Long-term improvements
## Scan Coverage
- Files scanned: X
- Technologies: Z
.claude/temp/security-audit-yourbench-2026-01-08-143022.md
Reports saved to .claude/temp/ (gitignored) for review.
Implement security feature → /security-audit → Fix issues → /commit