본문으로 건너뛰기
cccskills
무료GitHub에 공개

review-security

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto
설치 방법 보기

포함된 파일(3)

  • SKILL.md2.3 KB
  • agents/openai.yaml232 B
  • references/threat-checklist.md2.4 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Review Security

Workflow

  1. Establish the review target, intended behavior, and relevant threat model.
  2. Identify assets, trust boundaries, actors, entry points, and sensitive operations.
  3. Trace attacker-controlled data to security-relevant sinks.
  4. Inspect authentication, authorization, tenant isolation, and privilege changes.
  5. Evaluate realistic exploitability and existing controls.
  6. Validate suspected findings safely with read-only analysis or sandboxed tests when authorized.
  7. Return prioritized findings with evidence, impact, prerequisites, and remediation direction.

Guardrails

  • Work read-only by default.
  • Do not access production systems, real customer data, or private credentials.
  • Do not publish weaponized exploit details or active secrets.
  • Avoid checklist-only findings without a reachable attack path.
  • Distinguish a missing defense-in-depth measure from an exploitable vulnerability.
  • Treat dependency scanner output as leads requiring context.
  • Keep proof-of-concept activity scoped, reversible, and authorized.

Threat checklist

Read references/threat-checklist.md for changes involving identity, parsers, URLs, files, commands, serialization, secrets, data boundaries, CI, or cloud permissions.

Finding standard

Include:

  • severity and confidence;
  • affected asset and trust boundary;
  • attacker prerequisites;
  • source-to-sink or authorization path;
  • impact;
  • exact code location;
  • safe reproduction guidance when appropriate;
  • remediation and verification direction.

Acceptance criteria

  • Findings describe realistic attack paths.
  • Authorization and tenant boundaries are explicitly reviewed.
  • Sensitive data handling is traced through logs and storage.
  • False positives and assumptions are called out.
  • No live exploitation or unauthorized write occurred.
  • Residual risk and unreviewed surfaces are explicit.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

build-backend

무료

Build or modify backend APIs, services, jobs, persistence, and integrations while preserving contracts, authorization, data integrity, and failure behavior. Use for server-side features, database changes, background processing, backend defects, and service refactors; do not use for frontend-only or infrastructure-only work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

build-frontend

무료

Build or modify frontend interfaces using repository-native components while preserving accessibility, responsive behavior, state handling, and visual verification. Use for UI features, design implementation, forms, client-side defects, and frontend refactors; do not use for backend-only or infrastructure-only work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

choose-engineering-flow

무료

Select the smallest useful Codex engineering workflow from this repository's existing skills. Use when a task spans multiple engineering concerns, the user is unsure which skill to invoke, or loading every specialist would waste context; return a recommendation only and do not execute the engineering task.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

engineering-loop

무료

Implement a repository code or configuration change through reproduction, focused checks, review, and evidence. Use for end-to-end features and fixes; not for explanation-only, review-only, research, content publishing, or production operations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

evidence-review

무료

Review a small code or documentation change and return only evidence-backed correctness findings. Use in the Codex How To local plugin lab; do not modify files or post remote comments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

maintain-codex-wiki

무료

Maintain a review-first Markdown knowledge base for Codex practices with source provenance, engineering capture, citation-aware queries, explicit archive and promotion, and deterministic linting. Use when asked to capture a durable engineering lesson, ingest Codex research, query or archive what the repository knows, check wiki health, reconcile conflicting guidance, or promote verified knowledge.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Phelan164/codex-howto142026년 10월 17일 업데이트

Phelan164의 스킬 모두 보기

이 스킬의 문제 신고