スキル security-quick-review
📦

security-quick-review

v1.0 コンテンツリビジョン r2 安全 ⚙️ 外部コマンド

Review Code Changes for Security Risks

Code changes can introduce security problems that routine reviews miss. This skill guides focused AI triage with evidence, realistic severity, and concrete fixes.

対応: Claude Codex Code(CC)
Maintain this Skill? Claim it 🥉 78 ブロンズ

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト
Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/agentkitco-security-quick-review.md 署名済み manifest GET /api/skills/agentkitco-security-quick-review/manifest 署名済み lockfile GET /api/skills/agentkitco-security-quick-review/lockfile

テストする

「security-quick-review」を使用しています。 Illustrative scenario: an endpoint accepts a record identifier but never verifies that the caller owns the record.

期待される結果:

  • Scope: the changed endpoint and its authorization checks; deployment behavior was not reviewed.
  • HIGH: Missing ownership validation could let an authenticated caller access another user's record by changing the identifier.
  • Fix: enforce record-level authorization on the server before returning data.
  • A real finding must include the affected file and line; this illustration has no source attachment.
  • Limits: automated triage, not a security audit.

「security-quick-review」を使用しています。 Illustrative scenario: a credential was removed from the current change but remains visible in repository history.

期待される結果:

  • Scope: the selected change and its repository history.
  • HIGH: A historical credential remains exposed even after removal from current code.
  • Fix: rotate or revoke the credential and investigate its use; deleting current text does not invalidate it.
  • Evidence should identify the source location without reproducing the secret value.
  • Could not verify: whether the credential remains active.

セキュリティ監査

安全
v2 • 2026/10/22 バージョン別レポートを開く

All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.

1
スキャンされたファイル
47
解析済み行数
0
レビュー項目
0
誤検知を無視

リスク要因

⚙️ 外部コマンド (3)
SKILL.md:20 SKILL.md:25 SKILL.md:31-39
最新の完了済み静的・セマンティック監査では、確認済みのセキュリティ検出事項は見つかりませんでした。これは、スキルに副作用がないことを証明するものではありません。
監査者: codex 監査履歴を表示 →
このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く
セキュリティ評価

レポートリンクをコピー

https://skillstore.io/skills/agentkitco-security-quick-review/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学術引用 (APA · BibTeX · CFF)

APA形式の引用

agentkitco. (2026). security-quick-review security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/2

BibTeX形式の引用

@techreport{agentkitco-agentkitco-security-quick-review-2026, author = {agentkitco}, title = {security-quick-review security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-quick-review security audit report (audit version 2)" version: "1.0" type: report authors: - name: "agentkitco" date-released: "2026-10-22" url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/2" identifiers: - type: other value: "skillstore:agentkitco-security-quick-review:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由 証拠の信頼度: 中
55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠

作成できるもの

Check a Pull Request Before Merge

Review changed input handlers and related code for injection, exposed secrets, and unsafe error behavior.

Review Access Controls

Examine routes and actions for missing server-side checks and access to another user's records.

Inspect Dependency and Configuration Changes

Review package additions, lockfiles, debug settings, and new CI or cloud permissions within the selected change.

これらのプロンプトを試す

Review a Small Change 
Review my current diff for likely security issues. State the scope, cite evidence, suggest fixes, and list anything you cannot verify.
Inspect an Endpoint 
Review [endpoint] and its called code for untrusted input, injection, authentication, authorization, and data exposure. Report evidence and concrete fixes without live exploitation.
Check Secrets and Configuration 
Review [directory] and its scoped Git changes and history for exposed secrets, dependency risks, and configuration weaknesses. Never reproduce secret values; recommend rotation when needed.
Trace a Sensitive Workflow 
Review [workflow] across changed code and called modules. Trace authorization, input boundaries, unsafe operations, and failure behavior. Separate evidence from uncertainty and identify human-review needs.

ベストプラクティス

  • Specify the diff, directory, endpoint, or workflow and include relevant called code.
  • Require file and line evidence, realistic impact, concrete fixes, and explicit verification gaps.
  • Rotate exposed secrets and obtain human review for workflows handling money, health, or identity data.

回避

  • Treating a clean triage report as proof that an application is secure.
  • Pasting secret values into reports or assuming deletion removes historical exposure.
  • Attempting live exploitation or accepting generic vulnerability lists without source evidence.

よくある質問

Is this a complete security audit?
No. It provides focused AI triage, not a security audit or penetration test.
Which AI tools are supported?
The marketplace lists Claude, Codex, and Claude Code. Review depth depends on available source context and tool access.
What does the review cover?
It covers secrets, untrusted input, injection, access controls, data exposure, unsafe operations, dependencies, configuration, and failure behavior.
Does it run attacks against live systems?
No. The skill prohibits live exploitation and allows code inspection and local tests.
How does it handle exposed secrets?
It requests source locations without secret values and recommends rotation because removal from current code does not erase Git history.
What should a useful report include?
Include scope, severity, source evidence, an abuse explanation, concrete fixes, clean categories, verification gaps, and the limits of automated triage.

開発者情報

作成者

agentkitco

ライセンス

MIT

作者バージョン

v1.0

Skillstore リビジョン

r2

バージョンに関する注意

作者が宣言したバージョンは有効な SemVer ではありません。

リポジトリ

https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review

参照

18efac79a818d7e997295839638fdd21906cfd1c

メンテナンスの新しさ

2026/10/22

利用状況

6 ダウンロード · 0 閲覧

ファイル構成

📄 SKILL.md

agentkitco のその他のスキル

すべて表示

関連スキル

すべて表示