security-review

仓库创建 2026年7月27日最近提交 1 天前SkillHot 收录 1 天前

▸ 精选理由

适合合并前或关键变更时的扫描-修复-复测闭环审计。

▸ 风险提示

需要访问完整代码与依赖，可能涉及敏感配置或凭证权限。

这个 Skill 做什么

按 OWASP Top10:2025 对代码做静态安全审计并给出修复方案。

按 OWASP Top10:2025 做静态安全审计，覆盖注入、越权、机密泄露、加密与供应链等常见风险，并给出具体可执行的修复步骤。适合在合并触及认证、输入处理、加密、依赖等改动前或要做漏洞评估时使用。流程是扫描→修复→复扫，只有“干净”或“显式接受风险”两种终态，输出不是笼统建议而是可落地的修复方案。

▸ 展开 SKILL.md 英文原文

Audits code for security vulnerabilities against OWASP Top 10 2025 with concrete fix recipes: injection, broken access control, secrets, crypto, supply chain. Use before merging auth/input/crypto/dependency changes, or when the user says security review, vulnerability, pentest, XSS, or secrets.

开发编程安全审计OWASP漏洞修复代码扫描通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/Ludenox-GIT/portable-agent-skills/main/skills/security-review/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/Ludenox-GIT/portable-agent-skills/main/skills/security-review/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Security Review

Static code audit against OWASP Top 10:2025, run as a scan -> fix -> rescan loop that only terminates in one of two states: **clean** or **explicitly accepted risk**.

## When to use

- Before merging changes that touch auth, sessions, input handling, crypto, file upload, deserialization, CI config, or dependencies.
- When the user says: security review, audit, vulnerability, pentest, XSS, SQL injection, IDOR, CSRF, leaked key, secrets.
- After any suspected secret leak (rule #29 applies immediately).

When NOT to use:

- Style/readability/architecture review with no security angle — do a normal code review.
- Runtime penetration testing, network scanning, fuzzing, social

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有