Agent Skills
› Hmbown/CodeWhale
› security-review
security-review
GitHub用于审查信任边界、认证授权、注入漏洞、密钥泄露及依赖安全，评估可利用性并提供修复建议，非正式审计。
Trigger Scenarios
寻找应用漏洞
检查认证授权缺陷
排查密钥泄露风险
评估不安全信任边界
Install
npx skills add Hmbown/CodeWhale --skill security-review -g -y
SKILL.md
Frontmatter
{
"name": "security-review",
"invocation": "model+user",
"description": "Review trust boundaries, auth\/authz, injection, secrets, filesystem\/network exposure, dependencies, and exploitability without pretending a shallow lint is an audit."
}
Security Review
When to use
Use when looking for vulnerabilities, auth holes, secret leaks, or unsafe trust boundaries.
Non-goals
- This is not a formal audit certificate.
- Do not claim exploitability without evidence.
Workflow
- Map trust boundaries and entry points.
- Check auth/authz, injection, secrets, FS/network exposure, deps.
- Rank findings by exploitability and impact.
- Recommend fixes and verification steps.
Version History
- b0e4926 Current 2026-07-24 17:43
