‹ 首页

security-review

@mahsumaktas · 收录于 1 周前 · 上游提交 4 个月前

Security audit checklist for code changes. Run before committing to catch vulnerabilities.

场景代码提交前安全审计

适合你，如果你在提交代码前需要快速检查常见安全问题

/ 下载安装
https://github.com/mahsumaktas/agent-evolution-kit/tree/main/skills/security-review ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add mahsumaktas/agent-evolution-kit/security-review
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- mahsumaktas/agent-evolution-kit/security-review
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify mahsumaktas/agent-evolution-kit/security-review
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
1GitHub stars
~471上下文体积 · 单文件
索引托管

怎么用

商店整理自技能原文 · 版本 c599c87 · 表述以原文为准
它做什么

Claude 会按照安全审查清单检查你的代码变更，覆盖输入验证、认证授权、密钥管理、依赖安全、错误处理、数据保护、注入防御和配置等方面，并给出严重等级（致命、高、中、低）及修复建议。

什么时候触发

当你要求 Claude 审查代码变更的安全性，或在提交前运行安全检查时触发。

装好后可以这样说
Claude 会运行完整的安全检查清单。
Claude 会重点检查输入验证和注入防御。
Claude 会针对变更部分进行安全审查。
技能原文 SKILL.md作者撰写 · MIT · c599c87

Security Review

Automated security review checklist for code changes. Covers OWASP Top 10, dependency vulnerabilities, secret exposure, and injection vectors.

Checklist

Run against all modified files before commit:

1. Input Validation
  • [ ] All user inputs validated and sanitized
  • [ ] SQL queries use parameterized statements (no string concatenation)
  • [ ] Shell commands use safe argument passing (no interpolation)
  • [ ] Path traversal prevented (no ../ in user paths)
  • [ ] File uploads validated (type, size, name)
2. Authentication & Authorization
  • [ ] Auth checks on all protected endpoints
  • [ ] Session tokens are cryptographically random
  • [ ] Password hashing uses bcrypt/argon2 (not MD5/SHA1)
  • [ ] API keys not hardcoded in source
3. Secrets Management
  • [ ] No secrets in source code (API keys, passwords, tokens)
  • [ ] .env files in .gitignore
  • [ ] Environment variables used for configuration
  • [ ] No secrets in log output or error messages
4. Dependency Security
  • [ ] Dependency audit passes
  • [ ] No known CVEs in dependencies
  • [ ] Lock files committed and up to date
  • [ ] Minimal dependency footprint
5. Error Handling
  • [ ] Error messages don't leak internal details
  • [ ] Stack traces not exposed to users
  • [ ] Graceful degradation on failure
  • [ ] Timeouts configured for external calls
6. Data Protection
  • [ ] Sensitive data encrypted at rest
  • [ ] HTTPS enforced for all external communication
  • [ ] PII handling follows minimum exposure principle
  • [ ] Logs don't contain sensitive user data
7. Injection Prevention
  • [ ] XSS: Output encoding applied
  • [ ] CSRF: Tokens used for state-changing operations
  • [ ] Command injection: Safe argument passing, no shell interpolation with user data
  • [ ] SSRF: External URL validation
8. Configuration
  • [ ] Debug mode disabled in production
  • [ ] CORS configured restrictively
  • [ ] Security headers set (CSP, HSTS, X-Frame-Options)
  • [ ] Rate limiting on sensitive endpoints
Severity Levels
  • CRITICAL: Must fix before commit (secrets exposure, SQL injection)
  • HIGH: Should fix before merge (missing auth, XSS)
  • MEDIUM: Fix in same sprint (missing rate limiting, verbose errors)
  • LOW: Track and fix later (minor header issues)
按 MIT 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…