菜单
Security audit with Sentinel. Checks for vulnerabilities, secrets, dependencies, and security best practices. Use before shipping or when working on auth/crypto/sensitive areas.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | dev-security |
| description | Security audit with Sentinel. Checks for vulnerabilities, secrets, dependencies, and security best practices. Use before shipping or when working on auth/crypto/sensitive areas. |
Delegate to Sentinel for comprehensive security review.
"Every line of code is guilty until proven innocent."
# What changed?
git diff --name-only HEAD~10 2>/dev/null || git diff --name-only
# What's the scope?
ls -la
Delegate to Sentinel agent:
"Sentinel, security audit time.
Scope: {describe what changed or focus area}
Run your full checklist:
1. Secrets scan
2. Dependency audit
3. Injection vectors
4. Auth/authz review
5. Crypto check
Files changed: {list from git diff}
Be thorough. We're not shipping vulnerabilities."
Sentinel returns findings by severity:
If CRITICAL or HIGH found:
Security audit found issues:
CRITICAL:
- [Issue 1 with location and fix]
HIGH:
- [Issue 2 with location and fix]
Options:
1. Fix now (Bob will implement Sentinel's fixes)
2. Fix manually, run /dev-security again
3. Accept risk (requires explicit acknowledgment)
4. Get second opinion (run deeper audit)
If only MEDIUM/LOW:
Security audit passed with notes.
MEDIUM:
- [Issue with suggestion]
LOW:
- [Issue with suggestion]
These don't block shipping but should be tracked.
Add to backlog? (y/n)
If clean:
Security audit passed!
Sentinel says: "Huh. Someone actually read the OWASP guide. Respect."
Ready for:
- /dev-rc - Release candidate
- /dev-finish - Close the cycle
If active dev-cycle session:
## Security Audit
- **Date**: {timestamp}
- **Status**: PASSED | PASSED_WITH_NOTES | FAILED
- **Critical**: 0
- **High**: 0
- **Medium**: 2
- **Low**: 1
### Findings
{Summary of what was found and resolved}
/dev-security
Everything: secrets, deps, code, config, infra
/dev-security quick
Just the critical stuff: secrets, known CVEs, obvious injection
/dev-security auth
/dev-security crypto
/dev-security deps
/dev-security secrets
Focus on one area for deeper review.
| Area | What | Why |
|---|---|---|
| Secrets | Hardcoded keys, tokens, passwords | #1 breach cause |
| Dependencies | Known CVEs, outdated packages | Supply chain attacks |
| Injection | SQL, XSS, command, path traversal | OWASP Top 10 |
| Auth | Broken auth, missing authz | Gateway to everything |
| Crypto | Weak algorithms, hardcoded keys | Data protection |
| Config | Exposed debug, permissive CORS | Misconfiguration |
With dev-cycle: Logs findings to session With dev-rc: Security must pass for release candidate With Bob: Implements fixes for findings With Sentinel: The security brain
Read Claude Code documentation to learn about features, capabilities, hooks, skills, MCP, subagents, and how to use Claude Code effectively.
Close a dev-cycle session, capture learnings, and optionally commit. Use when development work is complete and ready to wrap up.
Fully autonomous development mode. Spec in, production-ready software out. Claude makes decisions, uses agents, commits locally. Only stops for hard blockers.
Run QA checks on current work. Tests, linting, type checking, build verification. Use during or after development to catch issues early.
Release candidate preparation. Final checks before merge - QA, security, review, changelog. The last gate before shipping.
Start or resume a development session. Use when beginning feature work, implementing changes, or continuing previous work. Orchestrates discovery, planning, review, and build phases with Bob and Garry.