跳到正文
cccskills
免费在 GitHub 公开

security-engineering

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(11)

  • SKILL.md4.6 KB
  • references/agentic-ai-security.md1.8 KB
  • references/api-security.md3.4 KB
  • references/asvs-5.md590 B
  • references/cicd-security.md2.7 KB
  • references/code-review-checklist.md1.6 KB
  • references/infrastructure-security.md2.2 KB
  • references/language-specific.md3.2 KB
  • references/owasp-top-10.md908 B
  • references/secure-code-patterns.md1.6 KB
  • references/web3-smart-contracts.md2.6 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Security Engineering

Cross-stack security rules covering API security, infrastructure hardening, Web3 smart contracts, CI/CD review automation, and agentic AI risks. Aligned to OWASP Top 10:2025, ASVS 5.0, and OWASP Agentic Security Initiative 2026.

When reviewing code, think like a senior security researcher: trace user input through to sensitive operations, prefer fail-closed designs, and never trust the client.

Universal Rules

  • Validate every input server-side with Zod (or equivalent) at the API boundary.
  • Parameterize all queries — Prisma/Drizzle, never string concatenation.
  • Authorize on every request — deny by default, verify ownership.
  • Hash passwords with Argon2 or bcrypt — never MD5/SHA1, never plaintext.
  • No hardcoded secrets — env vars validated at startup, secrets in vault, .env in .gitignore.
  • TLS everywhere, encryption at rest on all data stores.
  • Fail-closed on auth/permission errors. Never expose stack traces to users.
  • Log security events with sanitization — redact authorization, cookie, CSRF headers.
  • Least-privilege IAM — scope to specific actions and resource ARNs, not *.
  • OIDC for CI/CD — no long-lived credentials in GitHub.
  • Smart contracts: ReentrancyGuard, SafeERC20, signed data must include chainid + address(this) + deadline, replay-prevention via usedHashes.

References

Related skills

  • web3-smart-contract-engineering — Solidity patterns, signature verification, replay protection (consult alongside references/web3-smart-contracts.md when auditing contracts)
  • deployment-pipelines — pipeline hardening, OIDC, untrusted-input handling in CI
  • godot-engineer — multiplayer games have real security concerns: cheating, save tampering, server-side validation, anti-replay. Pull this in for any networked game.

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Use when adversarially reviewing a document that makes formal or technical claims — math derivations, physics papers, statistical analyses, benchmark reports, whitepapers. Inventories every equation and quantitative claim, verifies each AS NAMED in the text (never a paraphrase or a neighboring statement), and classifies VERIFIED / REFUTED / UNVERIFIABLE / VACUOUS. Triggers on "check this paper", "verify these claims", "is this derivation right", "review this proof", "audit this benchmark", "does the math hold up". For source-code review see code-review-and-quality; for skill/agent library audits see skill-library-review; for content quality scoring see content-ops.

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

Run Karpathy-style autoresearch optimization on any content. Generates 50+ variants, scores with a 5-expert simulated panel, evolves winners through multiple rounds, outputs optimized version + full experiment log. Use when optimizing landing pages, email sequences, ad copy, headlines, form pages, CTA text, or any conversion-focused content. Triggers on "optimize this page", "run autoresearch", "score these variants", "A/B test this copy".

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

Conducts multi-axis code review across correctness, readability, architecture, security, and performance. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Triggers on "review my PR", "review this diff", "code review", "review this changeset", "is this ready to merge", "pre-merge review".

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

Estimate the full development cost of an existing codebase from lines of code, architectural complexity, and team-composition overhead. Use for 'how much would this cost to build', 'what did this codebase cost', development-cost or build-cost estimates, calendar-time estimates, and Claude/AI ROI on a delivered codebase. Estimates by measured LOC and complexity, not by ticket volume.

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

Auto-assembles a domain-specific expert panel (7–10 experts), scores any content or strategy artifact against a typed rubric, and iterates until the aggregate hits 90+ (max 3 rounds). Use as a quality gate on copy, email sequences, landing-page drafts, strategy docs, charts, titles, or recruiting evaluations — or when another skill needs a final review gate on its output. Triggers on "expert panel this", "score this", "rate these variants", "quality check this", "panel review", "expert score", "evaluate this copy/strategy/page". For variant generation and multi-round conversion optimization see autoresearch; for live-URL CRO auditing see conversion-ops; for the scripted content-production pipeline see content-pipeline.

中文简介正在准备中。当前显示原文说明。

LazyIsEfficient/agentic-os172026年7月17日 更新

查看 LazyIsEfficient 的全部技能

报告此技能的问题