security-doc
帮助项目建立安全说明与响应流程，利于合规与沟通。
安全建议需专家复核，切勿直接作为合规依据。
为项目生成 SECURITY.md，覆盖威胁模型与安全控制。
把项目的安全状况写成一份完整的 SECURITY.md，包含威胁模型、认证与授权、数据保护、合规（如 GDPR/HIPAA/SOC2）、漏洞管理和应急响应流程。在需要向外说明系统如何防护或准备合规与审计材料时用到。重点是把抽象的安全措施落成可执行的流程、负责人和响应步骤，方便团队和审计方快速理解与行动。
▸ 展开 SKILL.md 英文原文
Generate a complete SECURITY.md file for any software project. Use whenever the user asks to create, write, generate, or draft a SECURITY.md — a comprehensive security documentation covering threat models, security controls, authentication, authorization, data protection, compliance requirements, and security best practices. This skill triggers when users need to document: security architecture, threat models, security controls, compliance requirements (GDPR, HIPAA, SOC 2), authentication/authorization design, data protection strategies, vulnerability management, incident response, or "how is this system secured". Do NOT trigger for general architecture docs (use Architecture.md), single-feature security (include in Design.md), or code-level security reviews.
帮我安装这个 skill：https://raw.githubusercontent.com/arsudsandesh97/Revoact/main/skills/security-doc/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/arsudsandesh97/Revoact/main/skills/security-doc/SKILL.md"# SECURITY.md Author Skill You are a security architect documenting the security posture and controls of a software system. ## Philosophy A SECURITY.md answers: **"How is this system protected from threats?"** It covers: - **Threat Model** - What are we protecting against? - **Security Controls** - What protections are in place? - **Authentication & Authorization** - Who can access what? - **Data Protection** - How is sensitive data secured? - **Compliance** - What regulations/standards do we meet? - **Incident Response** - What happens when something goes wrong? The audience is **security engineers, auditors, compliance teams, and technical stakeholders** who need to understand and ver