技能 security-quick-review

📦

security-quick-review

Name: security-quick-review
Author: agentkitco

v1.0 內容修訂 r2 安全 ⚙️ 外部命令

Review Code Changes for Security Risks

Code changes can introduce security problems that routine reviews miss. This skill guides focused AI triage with evidence, realistic severity, and concrete fixes.

支援: Claude Codex Code(CC)

🥉 78 銅級

Maintain this Skill? Claim it 🥉 78 銅級

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/agentkitco-security-quick-review.md 已簽名 manifest GET /api/skills/agentkitco-security-quick-review/manifest 已簽名 lockfile GET /api/skills/agentkitco-security-quick-review/lockfile

測試它

正在使用「security-quick-review」。 Illustrative scenario: an endpoint accepts a record identifier but never verifies that the caller owns the record.

預期結果:

Scope: the changed endpoint and its authorization checks; deployment behavior was not reviewed.
HIGH: Missing ownership validation could let an authenticated caller access another user's record by changing the identifier.
Fix: enforce record-level authorization on the server before returning data.
A real finding must include the affected file and line; this illustration has no source attachment.
Limits: automated triage, not a security audit.

正在使用「security-quick-review」。 Illustrative scenario: a credential was removed from the current change but remains visible in repository history.

預期結果:

Scope: the selected change and its repository history.
HIGH: A historical credential remains exposed even after removal from current code.
Fix: rotate or revoke the credential and investigate its use; deleting current text does not invalidate it.
Evidence should identify the source location without reproducing the secret value.
Could not verify: whether the credential remains active.

安全審計

安全

v2 • 2026/10/22 開啟版本化報告

All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.

已掃描檔案

分析行數

複核項目

已忽略的誤報

風險因素

⚙️ 外部命令 (3)

SKILL.md:20 SKILL.md:25 SKILL.md:31-39

最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/agentkitco-security-quick-review/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

agentkitco. (2026). security-quick-review security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/2

BibTeX 引用

@techreport{agentkitco-agentkitco-security-quick-review-2026,
  author = {agentkitco},
  title = {security-quick-review security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/2},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-quick-review security audit report (audit version 2)"
version: "1.0"
type: report
authors:
  - name: "agentkitco"
date-released: "2026-10-22"
url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/2"
identifiers:
  - type: other
    value: "skillstore:agentkitco-security-quick-review:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Check a Pull Request Before Merge

Review changed input handlers and related code for injection, exposed secrets, and unsafe error behavior.

Review Access Controls

Examine routes and actions for missing server-side checks and access to another user's records.

Inspect Dependency and Configuration Changes

Review package additions, lockfiles, debug settings, and new CI or cloud permissions within the selected change.

試試這些提示

Review a Small Change

Review my current diff for likely security issues. State the scope, cite evidence, suggest fixes, and list anything you cannot verify.

Inspect an Endpoint

Review [endpoint] and its called code for untrusted input, injection, authentication, authorization, and data exposure. Report evidence and concrete fixes without live exploitation.

Check Secrets and Configuration

Review [directory] and its scoped Git changes and history for exposed secrets, dependency risks, and configuration weaknesses. Never reproduce secret values; recommend rotation when needed.

Trace a Sensitive Workflow

Review [workflow] across changed code and called modules. Trace authorization, input boundaries, unsafe operations, and failure behavior. Separate evidence from uncertainty and identify human-review needs.

最佳實務

Specify the diff, directory, endpoint, or workflow and include relevant called code.
Require file and line evidence, realistic impact, concrete fixes, and explicit verification gaps.
Rotate exposed secrets and obtain human review for workflows handling money, health, or identity data.

避免

Treating a clean triage report as proof that an application is secure.
Pasting secret values into reports or assuming deletion removes historical exposure.
Attempting live exploitation or accepting generic vulnerability lists without source evidence.

常見問題

Is this a complete security audit?

No. It provides focused AI triage, not a security audit or penetration test.

Which AI tools are supported?

The marketplace lists Claude, Codex, and Claude Code. Review depth depends on available source context and tool access.

What does the review cover?

It covers secrets, untrusted input, injection, access controls, data exposure, unsafe operations, dependencies, configuration, and failure behavior.

Does it run attacks against live systems?

No. The skill prohibits live exploitation and allows code inspection and local tests.

How does it handle exposed secrets?

It requests source locations without secret values and recommends rotation because removal from current code does not erase Git history.

What should a useful report include?

Include scope, severity, source evidence, an abuse explanation, concrete fixes, clean categories, verification gaps, and the limits of automated triage.

開發者詳細資訊

作者

agentkitco

授權

MIT

作者版本

v1.0

Skillstore 修訂

版本提示

作者聲明的版本不符合 SemVer 規範。

儲存庫

https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review

引用

18efac79a818d7e997295839638fdd21906cfd1c

維護新鮮度

2026/10/22

使用量

6 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md