菜单
Security review checklist for authentication, authorization, and sensitive data handling. Use when changing auth, MFA, secrets, input validation, or security-critical features. Not for general code review.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Manage SublinkPro proxy subscriptions via its REST API — add/query nodes, build and share subscriptions, manage airports, templates (incl. AI template editing), tags, and view dashboard stats. Use when the user wants to operate their SublinkPro instance.
MANDATORY post-development workflow orchestrating validation, synchronization, and testing phases. Automatically invoked by AI agents after code changes. BLOCKING - work is incomplete without this.
MANDATORY pre-commit validation executor. Runs all required checks before any commit. NOT optional - must be invoked before every git add/commit/PR.
Cross-layer synchronization guide for backend, frontend, and documentation changes. Invoked by post-dev-workflow when changes affect multiple layers. Not for direct user invocation.
Documentation synchronization checklist for API, configuration, and feature changes. Invoked by post-dev-workflow when code affects documentation. Not for direct user invocation.
Performance review checklist for optimization, scalability, and resource usage. Use when changes affect queries, APIs, rendering, caching, or algorithms. Not for simple config changes.
| name | security-review |
| description | Security review checklist for authentication, authorization, and sensitive data handling. Use when changing auth, MFA, secrets, input validation, or security-critical features. Not for general code review. |
| version | 2.0.0 |
| author | SublinkPro Team |
| user-invocable | true |
This skill provides a comprehensive security review checklist for code changes that involve authentication, authorization, sensitive data handling, or security-critical features.
When to use: When making changes to:
Check for:
Detailed guide: references/authentication-guide.md (includes code examples)
Relevant files:
api/auth.goapi/auth_mfa.gomiddlewares/auth.gomiddlewares/mfa.goCheck for:
Detailed guide: references/mfa-guide.md
Relevant files:
api/auth_mfa.gomodels/mfa.gomiddlewares/mfa.goCheck for:
Detailed guide: references/sensitive-data-guide.md (includes code examples)
Check for:
../ attacks)?Detailed guide: references/input-validation-guide.md (includes code examples)
Check for:
Where with ?)?Detailed guide: references/database-security-guide.md (includes code examples)
Check for:
* in production)?Detailed guide: references/api-security-guide.md (includes code examples)
Check for:
crypto/rand used (not math/rand)?Detailed guide: references/cryptography-guide.md (includes code examples)
Check for:
Detailed guide: references/file-security-guide.md (includes code examples)
Check for:
Detailed guide: references/session-management-guide.md (includes code examples)
Check for:
Detailed guide: references/dependency-security-guide.md
Scan commands:
# Go: Check for known vulnerabilities
govulncheck ./...
# Frontend: Check npm dependencies
cd webs && yarn audit
Review the diff and identify if the change involves authentication, sensitive data, user input, database queries, API endpoints, file operations, or cryptographic operations.
Go through the relevant sections above and verify each item. Consult detailed guides in references/ for in-depth coverage.
gosec, eslint-plugin-security)Run security linters:
# Backend: gosec
go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec ./...
# Frontend: eslint with security plugin (if configured)
cd webs
yarn lint
If the change has security implications:
docs/security-guidelines.md if introducing new security patternsBefore completing the security review:
gosec, ESLint) pass with no critical issuesdocs/security-guidelines.mdreferences/*.md