技能 security-quick-review
📦

security-quick-review

v1.0 内容修订 r1 安全 ⚙️ 外部命令

Review Code Changes for Security Risks

Security defects can hide in small changes to input handling, authentication, and configuration. This skill guides scoped code triage with evidence, realistic severity, and actionable fixes.

支持: Claude Codex Code(CC)
你是维护者？认领此 Skill 🥉 77 青铜

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/agentkitco-security-quick-review.md 已签名 manifest GET /api/skills/agentkitco-security-quick-review/manifest 已签名 lockfile GET /api/skills/agentkitco-security-quick-review/lockfile

测试它

正在使用“security-quick-review”。 Illustrative request: review a change that retrieves customer records by a supplied identifier.

预期结果:

  • Scope: the changed handler and its record lookup; deployed access policies were not reviewed.
  • Illustrative high-severity issue: missing ownership validation could expose another customer record.
  • Fix: constrain retrieval to the authenticated customer and add a local cross-account access test.
  • A real finding must include the reviewed file and line before this conclusion is accepted.
  • Limits: automated triage only; obtain human review for identity-sensitive changes.

正在使用“security-quick-review”。 Illustrative request: summarize a scoped review where no concrete issue was identified.

预期结果:

  • Scope: the supplied diff and available called code.
  • Checked, nothing found: secrets, injection, authorization, data exposure, unsafe operations, dependencies, and failure behavior.
  • Could not verify: deployed infrastructure permissions and runtime configuration.
  • Limits: no findings in the reviewed scope does not establish that the application is secure.

安全审计

安全
v1 • 2026/10/17 打开版本化报告

All five static findings are false positives from defensive review instructions, inline Markdown, and a fenced report template. The skill prohibits live exploitation and secret disclosure, while limiting review to scoped code and local tests. No evidence found of prompt injection, credential collection, or data exfiltration.

1
已扫描文件
47
分析行数
0
复核项
0
已忽略误报

风险因素

⚙️ 外部命令 (3)
SKILL.md:20 SKILL.md:25 SKILL.md:31-39
最新一次完成的静态与语义审计未检测到已确认的安全发现。这并不能证明该 Skill 没有副作用。
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/agentkitco-security-quick-review/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

agentkitco. (2026). security-quick-review security audit report (audit version 1) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/1

BibTeX 引用

@techreport{agentkitco-agentkitco-security-quick-review-2026, author = {agentkitco}, title = {security-quick-review security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/1}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-quick-review security audit report (audit version 1)" version: "1.0" type: report authors: - name: "agentkitco" date-released: "2026-10-17" url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/1" identifiers: - type: other value: "skillstore:agentkitco-security-quick-review:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Review a Sensitive Pull Request

Check authentication, input handling, and related call paths before merging a change.

Triage Dependency and Configuration Changes

Inspect package changes, lockfiles, CI permissions, and failure behavior within a defined release scope.

Prepare Findings for Human Review

Collect evidence, realistic impact, and verification gaps for a focused follow-up security assessment.

试试这些提示

Review One Change 
Review this diff for likely security issues. State the scope, cite file and line evidence, and suggest specific fixes without revealing secrets.
Inspect an Endpoint 
Review [endpoint] and its called code for untrusted input, injection, authorization gaps, and data exposure. Separate verified findings from unresolved questions.
Assess a Release Diff 
Review [release diff] for secret exposure, dependency changes, configuration permissions, and failure behavior. Inspect scoped Git history without printing secret values.
Trace Sensitive Data Access 
Trace authorization and data flow through [module] and its callers. Rank evidence-backed risks, propose local regression tests, and identify checks requiring human verification.

最佳实践

  • Provide a clear diff or module scope and make relevant called code available.
  • Require file and line evidence, realistic impact, and a specific fix for every finding.
  • Keep secret values out of reports and rotate confirmed exposed credentials.

避免

  • Treating automated triage as proof of security or a substitute for a professional audit.
  • Testing exploit ideas against live systems during the review.
  • Publishing secret values or generic vulnerability lists without concrete code evidence.

常见问题

Is this a full security audit?
No. It guides fast AI-assisted triage and explicitly states that results are not a security audit or penetration test.
What code should I provide?
Provide a diff, directory, or endpoint and the relevant code it calls. Clearly identify anything outside the review scope.
Does it execute attacks against production?
No. The instructions prohibit exploitation against live systems and permit code inspection and local tests.
How are exposed secrets reported?
Reports identify the file and line without repeating secret values. Confirmed exposed credentials should be rotated, even after removal from code.
Does it include a standalone security scanner?
No. The skill supplies review instructions and a report format, not a bundled scanner or vulnerability database.
What does a clean result mean?
It means no issue was found in the reviewed scope. Runtime checks, infrastructure verification, and sensitive-domain human review may still be necessary.

开发者详情

作者

agentkitco

许可证

MIT

作者版本

v1.0

Skillstore 修订

r1

版本提示

作者声明的版本不符合 SemVer 规范。

仓库

https://github.com/agentkitco/agentkit-dev-skills/tree/3de707c7875147b65ddff504d86b0d0dbf713fa7/skills/security-quick-review

引用

743429f75b17204d47661a86b577a575ad67517f

维护新鲜度

2026/10/17

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md

agentkitco 的更多技能

查看全部

相关技能

查看全部