搜索
搜索结果
135 results for "security review"
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
affaan-msecurity-review
在添加身份验证、处理用户输入、使用密钥、创建API端点或实现支付/敏感功能时使用此技能。提供全面的安全检查清单和模式。
affaan-m
cc-skill-security-review
This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.
sickn33
security-review
AI驱动的代码库安全扫描器，像安全研究员一样推理代码——追踪数据流、理解组件交互、捕捉模式匹配工具遗漏的漏洞。当被要求扫描代码安全漏洞、查找错误、检查SQL注入、XSS、命令注入、暴露的API密钥、硬编码密钥、不安全的依赖、访问控制问题，或任何类似“我的代码安全吗？”、“审查安全问题”、“审计此代码库”或“检查漏洞”的请求时，使用此技能。涵盖JavaScript、TypeScript、Python、Java、PHP、Go、Ruby和Rust中的注入缺陷、身份验证和访问控制错误、密钥暴露、弱加密、不安全的依赖以及业务逻辑问题。
github
security-reviewer
识别安全漏洞，生成带有严重性评级的结构化审计报告，并提供可操作的修复指导。用于执行安全审计、审查代码漏洞或分析基础设施安全。适用于SAST扫描、渗透测试、DevSecOps实践、云安全审查、依赖审计、密钥扫描或合规检查。生成漏洞报告、优先级排序的建议和合规检查清单。
jeffallan
gha-security-review
对GitHub Actions工作流进行安全审查，发现可利用的漏洞。当被要求“审查GitHub Actions”、“审计工作流”、“检查CI安全”、“GHA安全”、“工作流安全审查”，或审查.github/workflows/中的pwn请求、表达式注入、凭证窃取和供应链攻击时使用。专注于利用，提供具体的PoC场景。
getsentrysecurity-review
安全代码审查，用于发现漏洞。当被要求进行“安全审查”、“查找漏洞”、“检查安全问题”、“审计安全”、“OWASP审查”或审查代码中的注入、XSS、认证、授权、加密问题时使用。提供基于置信度的系统性审查报告。
getsentryintent-driven-development
Turn ambiguous or high-impact product and engineering changes into scoped, verifiable acceptance criteria before or alongside implementation. Use when a user asks to clarify a feature, define acceptance criteria, de-risk a security/data/migration/integration change, prepare implementation requirements for another agent, or make a complex request testable. Do not trigger for trivial edits, straightforward fixes, active debugging, code review, or implementation requests whose acceptance conditions are already clear unless the user explicitly invokes this skill.
affaan-mllm-trading-agent-security
Security patterns for autonomous trading agents with wallet or transaction authority. Covers prompt injection, spend limits, pre-send simulation, circuit breakers, MEV protection, and key handling. Use when an autonomous agent holds wallet or transaction authority and its limits, simulation, or key handling need review.
affaan-mnetwork-config-validation
Pre-deployment checks for router and switch configuration, including dangerous commands, duplicate addresses, subnet overlaps, stale references, management-plane risk, and IOS-style security hygiene. Use when reviewing a router or switch configuration before deployment.
affaan-mquarkus-security
Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security. Use when reviewing Quarkus authn/authz, JWT or OIDC, RBAC, validation, or secrets.
affaan-mquarkus-verification
Verification loop for Quarkus projects: build, static analysis, tests with coverage, security scans, native compilation, and diff review before release or PR.
affaan-mflutter-dart-code-review
Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.
affaan-mdocker-patterns
Docker and Docker Compose patterns for local development, hardened CLI installer harnesses, container security, networking, volumes, and multi-service orchestration. Use when creating or reviewing Dockerfiles and Compose services, testing installers across Linux distributions, or planning accurate native macOS and Windows validation.
affaan-mspringboot-verification
Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.
affaan-mquarkus-verification
适用于 Quarkus 项目的全套验证闭环：涵盖编译构建、静态代码检查、单测与覆盖率校验、安全扫描、原生镜像（Native Image）编译以及发布/提交 PR 前的代码 Diff 审查。
affaan-mflutter-dart-code-review
与库无关的 Flutter/Dart 代码审查清单，涵盖 Widget 最佳实践、状态管理模式（BLoC、Riverpod、Provider、GetX、MobX、Signals）、Dart 惯用法、性能、无障碍、安全性和整洁架构。
affaan-mspringboot-verification
Spring Boot 项目的验证循环：构建、静态分析、带覆盖率的测试、安全扫描以及发布或 PR 前的差异审查。
affaan-m
pr-review
审查 PyTorch 的 Pull Request（PR），重点检查代码质量、测试覆盖率、安全性以及向下兼容性（BC）。适用于 PR 审查、代码变更评审，或者当用户提及“review PR”、“code review”、“帮我看下这个 PR”等场景。
pytorch
doubt-driven-development
将每一个非平凡决策置于全新上下文的对抗性审查之下，然后再让其成立。当正确性比速度更重要时、在不熟悉的代码中工作时、风险较高时（生产环境、安全敏感逻辑、不可逆操作），或者任何一次自信的输出现在验证比以后调试更便宜时使用。
addyosmani
find-security-vulnerabilities-in-code
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
usestrixapplication-security-testing
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.
usestrixowasp-top-10-testing
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.
usestrixmanaged-pentesting-with-strix
Run a managed pentest of a web app or API through the app.strix.ai REST API — no local Docker, LLM key, or install needed. Create an API token, register domain/repository assets, launch and poll scans, triage vulnerabilities, export SARIF, download PDF/DOCX pentest reports for SOC 2 and other compliance evidence (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants continuous or scheduled pentesting-as-a-service, an auditor-ready pentest report, scans tracked in a team dashboard, or security testing from a sandboxed agent/CI environment with no infrastructure.
usestrix