Навыки security-quick-review

📦

security-quick-review

Name: security-quick-review
Author: agentkitco

v1.0 Ревизия содержимого r2 Безопасно ⚙️ Внешние команды

Review Code Changes for Security Risks

Code changes can introduce security problems that routine reviews miss. This skill guides focused AI triage with evidence, realistic severity, and concrete fixes.

Поддерживает: Claude Codex Code(CC)

🥉 78 Бронза

Maintain this Skill? Claim it 🥉 78 Бронза

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/agentkitco-security-quick-review.md Подписанный manifest GET /api/skills/agentkitco-security-quick-review/manifest Подписанный lockfile GET /api/skills/agentkitco-security-quick-review/lockfile

Протестировать

Использование «security-quick-review». Illustrative scenario: an endpoint accepts a record identifier but never verifies that the caller owns the record.

Ожидаемый результат:

Scope: the changed endpoint and its authorization checks; deployment behavior was not reviewed.
HIGH: Missing ownership validation could let an authenticated caller access another user's record by changing the identifier.
Fix: enforce record-level authorization on the server before returning data.
A real finding must include the affected file and line; this illustration has no source attachment.
Limits: automated triage, not a security audit.

Использование «security-quick-review». Illustrative scenario: a credential was removed from the current change but remains visible in repository history.

Ожидаемый результат:

Scope: the selected change and its repository history.
HIGH: A historical credential remains exposed even after removal from current code.
Fix: rotate or revoke the credential and investigate its use; deleting current text does not invalidate it.
Evidence should identify the source location without reproducing the secret value.
Could not verify: whether the credential remains active.

Аудит безопасности

Безопасно

v2 • 22.10.2026 Открыть версионный отчет

All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.

Просканировано файлов

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Факторы риска

⚙️ Внешние команды (3)

SKILL.md:20 SKILL.md:25 SKILL.md:31-39

Последний завершенный статический и семантический аудит не обнаружил подтвержденных проблем безопасности. Это не доказывает отсутствие побочных эффектов у навыка.

Аудитор:: codex Посмотреть историю аудитов →

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/agentkitco-security-quick-review/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

agentkitco. (2026). security-quick-review security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/2

Цитата BibTeX

@techreport{agentkitco-agentkitco-security-quick-review-2026,
  author = {agentkitco},
  title = {security-quick-review security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/2},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-quick-review security audit report (audit version 2)"
version: "1.0"
type: report
authors:
  - name: "agentkitco"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/2"
identifiers:
  - type: other
    value: "skillstore:agentkitco-security-quick-review:audit:2"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Check a Pull Request Before Merge

Review changed input handlers and related code for injection, exposed secrets, and unsafe error behavior.

Review Access Controls

Examine routes and actions for missing server-side checks and access to another user's records.

Inspect Dependency and Configuration Changes

Review package additions, lockfiles, debug settings, and new CI or cloud permissions within the selected change.

Попробуйте эти промпты

Review a Small Change

Review my current diff for likely security issues. State the scope, cite evidence, suggest fixes, and list anything you cannot verify.

Inspect an Endpoint

Review [endpoint] and its called code for untrusted input, injection, authentication, authorization, and data exposure. Report evidence and concrete fixes without live exploitation.

Check Secrets and Configuration

Review [directory] and its scoped Git changes and history for exposed secrets, dependency risks, and configuration weaknesses. Never reproduce secret values; recommend rotation when needed.

Trace a Sensitive Workflow

Review [workflow] across changed code and called modules. Trace authorization, input boundaries, unsafe operations, and failure behavior. Separate evidence from uncertainty and identify human-review needs.

Лучшие практики

Specify the diff, directory, endpoint, or workflow and include relevant called code.
Require file and line evidence, realistic impact, concrete fixes, and explicit verification gaps.
Rotate exposed secrets and obtain human review for workflows handling money, health, or identity data.

Избегать

Treating a clean triage report as proof that an application is secure.
Pasting secret values into reports or assuming deletion removes historical exposure.
Attempting live exploitation or accepting generic vulnerability lists without source evidence.

Часто задаваемые вопросы

Is this a complete security audit?

No. It provides focused AI triage, not a security audit or penetration test.

Which AI tools are supported?

The marketplace lists Claude, Codex, and Claude Code. Review depth depends on available source context and tool access.

What does the review cover?

It covers secrets, untrusted input, injection, access controls, data exposure, unsafe operations, dependencies, configuration, and failure behavior.

Does it run attacks against live systems?

No. The skill prohibits live exploitation and allows code inspection and local tests.

How does it handle exposed secrets?

It requests source locations without secret values and recommends rotation because removal from current code does not erase Git history.

What should a useful report include?

Include scope, severity, source evidence, an abuse explanation, concrete fixes, clean categories, verification gaps, and the limits of automated triage.

Сведения для разработчиков

Автор

agentkitco

Лицензия

MIT

Версия автора

v1.0

Ревизия Skillstore

Примечание о версии

Заявленная автором версия не соответствует SemVer.

Репозиторий

https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review

Ссылка

18efac79a818d7e997295839638fdd21906cfd1c

Актуальность поддержки

22.10.2026

Использование

6 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md