build-loop:security-methodology

仓库创建 2026年4月7日最近提交 21 天前SkillHot 收录 21 天前

▸ 精选理由

作为 security-reviewer 的评分规范，有助于统一审查标准。

这个 Skill 做什么

为跨安全边界的构建提供规范化的威胁建模与权限范围方法论。

帮你把跨安全边界的构建做到可评估：教你怎么做 threat modeling、限定权限范围并写出评审用的证据。会在涉及 auth/authz、密钥处理、网络暴露或敏感数据持久化，或风险面改变时使用。特点是它是 security-reviewer 打分和 defenseclaw-bridge 映射的规范——不是运行时防御，不会拦截或改写请求，只给出审查标准和矩阵。

▸ 展开 SKILL.md 英文原文

Use when a build crosses a security boundary (auth, authz, secrets handling, network exposure, persistence of sensitive data) or when Phase 1 Assess flags `triggers.riskSurfaceChange: true`. Provides the threat-modeling and scoped-permission methodology for build-loop's security-reviewer agent.

开发编程威胁建模安全方法论权限边界通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/tyroneross/build-loop/main/skills/security-methodology/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/tyroneross/build-loop/main/skills/security-methodology/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- SPDX-FileCopyrightText: 2025-2026 Tyrone Ross, Jr <46267523+tyroneross@users.noreply.github.com> | SPDX-License-Identifier: Apache-2.0 -->

# Security Methodology

This is the canon the `security-reviewer` agent grades against, and the canon the `defenseclaw-bridge` skill maps to runtime config. It is **not** a runtime defense layer: it does not block prompts, it does not rewrite outputs, it does not replace DefenseClaw / NeMo Guardrails / Llama Guard. It tells you (a) what risk classes exist, (b) how to detect them by reading code, and (c) which IDs from which framework apply.

## When to load

- **Auto-loaded** by `agents/security-reviewer.md` in Phase 4 Review sub-step A whenever Ass

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有