菜单
Use when reviewing code or a PR for high-confidence, real-exploitation security vulnerabilities (>80% confidence threshold, low false positives).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when creating, editing, reviewing, or rendering software architecture or flow diagrams — C4 diagrams (system context, container, component, deployment, dynamic), sequence diagrams, request-flow visuals, or any Mermaid authoring where the rendered output must be readable. Also use when a Mermaid diagram renders with overlapping labels, parse errors, or a single-column layout, or when the user asks to "diagram the architecture", "draw the request flow", "map the sequences", or wants LucidChart-quality output from Mermaid.
Use when about to create a feature, build a component, add functionality, modify behavior, or start any new work — or when the user asks how should we, what approach, which way, explore options, design X, or spec this out. Triggers before any code, scaffold, or implementation skill runs.
Use when one request spans multiple domains (e.g. code + tests + docs + security + diagrams), has independent workstreams that could run concurrently, or is too large for a single agent in one pass — symptoms include "do all of X, Y, and Z", a multi-part review, or a task that would obviously thrash one agent's context
Use when defining product requirements, writing or updating a PRD, spec'ing out a feature, or deciding what to build — or when the user says write requirements, create a PRD, define the product, what should we build, or hands over stakeholder/engineering feedback to fold into an existing PRD. Especially for non-technical users translating a conversation into structured requirements.
Use when you want brutal, worst-case review of code resilience -- failure modes, race conditions, blast radius, and edge cases optimistic reviewers miss.
Use when saving or restoring agent context across sessions -- the user asks to save state, create a handoff, or pause, or the context window nears capacity; or to resume with load handoff, resume from, or continue where we left off.
| name | security-review |
| description | Use when reviewing code or a PR for high-confidence, real-exploitation security vulnerabilities (>80% confidence threshold, low false positives). |
| context | fork |
| agent | security-review |
| model | opus |
| allowed-tools | Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git status), Bash(git branch:*), Bash(gh pr view:*), Bash(gh pr diff:*), Read, Glob, Grep, LS, Task |
| tags | ["security","review"] |
| tier | core |
Conduct a security-focused code review of the pending changes.
GIT STATUS:
!`git status`
PR METADATA:
!`gh pr view --json title,body,author,files,additions,deletions,headRefName,state 2>/dev/null || echo "No PR context - reviewing local branch"`
FILES MODIFIED:
!`gh pr diff --name-only 2>/dev/null || git diff --name-only origin/HEAD...`
COMMITS:
!`gh pr view --json commits --jq '.commits[].messageHeadline' 2>/dev/null || git log --oneline origin/HEAD...`
DIFF CONTENT:
!`gh pr diff 2>/dev/null || git diff --merge-base origin/HEAD`
Use the security-review agent to identify HIGH-CONFIDENCE security vulnerabilities in the diff above. Focus only on issues with >80% confidence of real exploitability. Your final reply must contain the markdown report.
references/OWASP_TOP_10.md — OWASP Top 10 quick referencereferences/FALSE_POSITIVE_GUIDE.md — Detailed false positive filtering guide