Agent Skills
› Hmbown/CodeWhale
› security-review
security-review
GitHub用于审查信任边界、认证授权、注入漏洞、密钥泄露及依赖安全等风险。通过映射入口点并评估可利用性，提供修复建议与验证步骤，但不替代正式审计。
Trigger Scenarios
代码或架构安全审查
发现潜在漏洞或敏感信息泄露
评估系统信任边界和攻击面
Install
npx skills add Hmbown/CodeWhale --skill security-review -g -y
SKILL.md
Frontmatter
{
"name": "security-review",
"invocation": "model+user",
"description": "Review trust boundaries, auth\/authz, injection, secrets, filesystem\/network exposure, dependencies, and exploitability without pretending a shallow lint is an audit."
}
Security Review
When to use
Use when looking for vulnerabilities, auth holes, secret leaks, or unsafe trust boundaries.
Non-goals
- This is not a formal audit certificate.
- Do not claim exploitability without evidence.
Workflow
- Map trust boundaries and entry points.
- Check auth/authz, injection, secrets, FS/network exposure, deps.
- Rank findings by exploitability and impact.
- Recommend fixes and verification steps.
Version History
- b0e4926 Current 2026-07-24 17:43
