Habilidades security-quick-review
📦

security-quick-review

v1.0 Revisão do conteúdo r1 Seguro ⚙️ Comandos externos

Review Code Changes for Security Risks

Security defects can hide in small changes to input handling, authentication, and configuration. This skill guides scoped code triage with evidence, realistic severity, and actionable fixes.

Suporta: Claude Codex Code(CC)
Maintain this Skill? Claim it 🥉 77 Bronze

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente
Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/agentkitco-security-quick-review.md manifest assinado GET /api/skills/agentkitco-security-quick-review/manifest lockfile assinado GET /api/skills/agentkitco-security-quick-review/lockfile

Testar

Usando "security-quick-review". Illustrative request: review a change that retrieves customer records by a supplied identifier.

Resultado esperado:

  • Scope: the changed handler and its record lookup; deployed access policies were not reviewed.
  • Illustrative high-severity issue: missing ownership validation could expose another customer record.
  • Fix: constrain retrieval to the authenticated customer and add a local cross-account access test.
  • A real finding must include the reviewed file and line before this conclusion is accepted.
  • Limits: automated triage only; obtain human review for identity-sensitive changes.

Usando "security-quick-review". Illustrative request: summarize a scoped review where no concrete issue was identified.

Resultado esperado:

  • Scope: the supplied diff and available called code.
  • Checked, nothing found: secrets, injection, authorization, data exposure, unsafe operations, dependencies, and failure behavior.
  • Could not verify: deployed infrastructure permissions and runtime configuration.
  • Limits: no findings in the reviewed scope does not establish that the application is secure.

Auditoria de segurança

Seguro
v1 • 17/10/2026 Abrir o relatório versionado

All five static findings are false positives from defensive review instructions, inline Markdown, and a fenced report template. The skill prohibits live exploitation and secret disclosure, while limiting review to scoped code and local tests. No evidence found of prompt injection, credential collection, or data exfiltration.

1
Arquivos analisados
47
Linhas analisadas
0
Itens de revisão
0
Falsos positivos ignorados

Fatores de risco

⚙️ Comandos externos (3)
SKILL.md:20 SKILL.md:25 SKILL.md:31-39
A auditoria estática e semântica concluída mais recente não detectou achados de segurança confirmados. Isso não comprova que a skill não tenha efeitos colaterais.
Auditado por: codex
Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado
Avaliação de Segurança

Copiar link do relatório

https://skillstore.io/skills/agentkitco-security-quick-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

agentkitco. (2026). security-quick-review security audit report (audit version 1) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/1

Citação BibTeX

@techreport{agentkitco-agentkitco-security-quick-review-2026, author = {agentkitco}, title = {security-quick-review security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/1}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-quick-review security audit report (audit version 1)" version: "1.0" type: report authors: - name: "agentkitco" date-released: "2026-10-17" url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/1" identifiers: - type: other value: "skillstore:agentkitco-security-quick-review:audit:1" description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio
55
Arquitetura
85
Manutenibilidade
87
Conteúdo
65
Comunidade
83
Conformidade com a especificação

O que você pode criar

Review a Sensitive Pull Request

Check authentication, input handling, and related call paths before merging a change.

Triage Dependency and Configuration Changes

Inspect package changes, lockfiles, CI permissions, and failure behavior within a defined release scope.

Prepare Findings for Human Review

Collect evidence, realistic impact, and verification gaps for a focused follow-up security assessment.

Teste estes prompts

Review One Change 
Review this diff for likely security issues. State the scope, cite file and line evidence, and suggest specific fixes without revealing secrets.
Inspect an Endpoint 
Review [endpoint] and its called code for untrusted input, injection, authorization gaps, and data exposure. Separate verified findings from unresolved questions.
Assess a Release Diff 
Review [release diff] for secret exposure, dependency changes, configuration permissions, and failure behavior. Inspect scoped Git history without printing secret values.
Trace Sensitive Data Access 
Trace authorization and data flow through [module] and its callers. Rank evidence-backed risks, propose local regression tests, and identify checks requiring human verification.

Boas práticas

  • Provide a clear diff or module scope and make relevant called code available.
  • Require file and line evidence, realistic impact, and a specific fix for every finding.
  • Keep secret values out of reports and rotate confirmed exposed credentials.

Evitar

  • Treating automated triage as proof of security or a substitute for a professional audit.
  • Testing exploit ideas against live systems during the review.
  • Publishing secret values or generic vulnerability lists without concrete code evidence.

Perguntas frequentes

Is this a full security audit?
No. It guides fast AI-assisted triage and explicitly states that results are not a security audit or penetration test.
What code should I provide?
Provide a diff, directory, or endpoint and the relevant code it calls. Clearly identify anything outside the review scope.
Does it execute attacks against production?
No. The instructions prohibit exploitation against live systems and permit code inspection and local tests.
How are exposed secrets reported?
Reports identify the file and line without repeating secret values. Confirmed exposed credentials should be rotated, even after removal from code.
Does it include a standalone security scanner?
No. The skill supplies review instructions and a report format, not a bundled scanner or vulnerability database.
What does a clean result mean?
It means no issue was found in the reviewed scope. Runtime checks, infrastructure verification, and sensitive-domain human review may still be necessary.

Detalhes do desenvolvedor

Licença

MIT

Versão do autor

v1.0

Revisão da Skillstore

r1

Aviso de versão

A versão declarada pelo autor não é um SemVer válido.

Repositório

https://github.com/agentkitco/agentkit-dev-skills/tree/3de707c7875147b65ddff504d86b0d0dbf713fa7/skills/security-quick-review

Referência

743429f75b17204d47661a86b577a575ad67517f

Atualidade da manutenção

17/10/2026

Uso

0 downloads · 0 visualizações

Estrutura de arquivos

📄 SKILL.md

Mais de agentkitco

Ver tudo

Habilidades relacionadas

Ver tudo