Security

parcadei/continuous-claude-v3/.claude/skills/security

作者 parcadeid07ff4b06b62無授權條款3.9K 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫8 個月前更新

Security audit workflow - vulnerability scan → verification

僅含說明Security

AI 產生的概覽

執行兩階段安全稽核工作流程：弱點掃描，然後驗證修正。

功能: 此技能定義了一套安全稽核工作流程，先掃描程式碼中的弱點，再驗證修正情況。它涵蓋注入攻擊、身分驗證與授權問題、資料保護、設定問題以及相依性風險，並依嚴重程度報告發現的問題，附上位置與修復步驟。第二階段會重新檢查已回報的問題，執行安全相關測試與相依性稽核，並確認修正不會引入迴歸。
適用情境: 當被要求進行安全稽核、弱點檢查，或審查身分驗證、付款相關程式碼時使用。它適用於身分驗證、付款、使用者資料等安全敏感情境，也用於修正後重新驗證。
執行需求: 僅為說明性指示，不附帶指令碼。它依賴名為 aegis 與 arbiter 的代理子代理類型，並提到 npm audit、pip audit 等相依性稽核指令。

/security - Security Audit Workflow

Dedicated security analysis for sensitive code.

When to Use

"Security audit"
"Check for vulnerabilities"
"Is this secure?"
"Review authentication code"
"Check for injection attacks"
Before handling auth, payments, user data
After adding security-sensitive features

Workflow Overview

┌─────────┐    ┌───────────┐│  aegis  │───▶│ arbiter  ││         │    │           │└─────────┘    └───────────┘  Security       Verify  audit          fixes

┌─────────┐    ┌───────────┐│  aegis  │───▶│ arbiter  ││         │    │           │└─────────┘    └───────────┘  Security       Verify  audit          fixes

Agent Sequence

Why Dedicated Security?

The /review workflow focuses on code quality. Security needs:

Specialized vulnerability patterns
Dependency scanning
Secret detection
OWASP Top 10 checks
Authentication/authorization review

Execution

Phase 1: Security Audit

Task(  subagent_type="aegis",  prompt="""  Security audit: [SCOPE]
  Scan for:
  **Injection Attacks:**  - SQL injection  - Command injection  - XSS (Cross-Site Scripting)  - LDAP injection
  **Authentication/Authorization:**  - Broken authentication  - Session management issues  - Privilege escalation  - Insecure direct object references
  **Data Protection:**  - Sensitive data exposure  - Hardcoded secrets/credentials  - Insecure cryptography  - Missing encryption
  **Configuration:**  - Security misconfigurations  - Default credentials  - Verbose error messages  - Missing security headers
  **Dependencies:**  - Known vulnerable packages  - Outdated dependencies  - Supply chain risks
  Output: Detailed report with:  - Severity (CRITICAL/HIGH/MEDIUM/LOW)  - Location (file:line)  - Description  - Remediation steps  """)

Task(  subagent_type="aegis",  prompt="""  Security audit: [SCOPE]
  Scan for:
  **Injection Attacks:**  - SQL injection  - Command injection  - XSS (Cross-Site Scripting)  - LDAP injection
  **Authentication/Authorization:**  - Broken authentication  - Session management issues  - Privilege escalation  - Insecure direct object references
  **Data Protection:**  - Sensitive data exposure  - Hardcoded secrets/credentials  - Insecure cryptography  - Missing encryption
  **Configuration:**  - Security misconfigurations  - Default credentials  - Verbose error messages  - Missing security headers
  **Dependencies:**  - Known vulnerable packages  - Outdated dependencies  - Supply chain risks
  Output: Detailed report with:  - Severity (CRITICAL/HIGH/MEDIUM/LOW)  - Location (file:line)  - Description  - Remediation steps  """)

Phase 2: Verification (After Fixes)

Task(  subagent_type="arbiter",  prompt="""  Verify security fixes: [SCOPE]
  Run:  - Security-focused tests  - Dependency audit (npm audit, pip audit)  - Re-check reported vulnerabilities  - Verify fixes don't introduce regressions
  Output: Verification report  """)

Task(  subagent_type="arbiter",  prompt="""  Verify security fixes: [SCOPE]
  Run:  - Security-focused tests  - Dependency audit (npm audit, pip audit)  - Re-check reported vulnerabilities  - Verify fixes don't introduce regressions
  Output: Verification report  """)

Security Scopes

Full Codebase

Specific Area

Single File

Dependencies Only

Example

User: /security the payment processing code
Claude: Starting /security audit for payment code...
Phase 1: Security audit...[Spawns aegis]
┌─────────────────────────────────────────────────────────────┐│ Security Audit Report                                       │├─────────────────────────────────────────────────────────────┤│ Scope: src/services/payment/                                ││ Files scanned: 12                                           ││ Lines analyzed: 2,847                                       │├─────────────────────────────────────────────────────────────┤│ CRITICAL (1)                                                ││ ──────────                                                  ││ [C1] SQL Injection in payment.py:89                         ││      query = f"SELECT * FROM orders WHERE id = {order_id}"  ││      Fix: Use parameterized queries                         ││                                                             ││ HIGH (2)                                                    ││ ────────                                                    ││ [H1] Hardcoded API key in stripe_client.py:12               ││      STRIPE_KEY = "sk_live_..."                             ││      Fix: Move to environment variable                      ││                                                             ││ [H2] Missing input validation in refund.py:45               ││      amount = request.json['amount']  # No validation       ││      Fix: Validate amount is positive number                ││                                                             ││ MEDIUM (1)                                                  ││ ──────────                                                  ││ [M1] Verbose error messages in error_handler.py:23          ││      return {"error": str(e)}  # Leaks internal details     ││      Fix: Return generic message, log details internally    ││                                                             ││ LOW (0)                                                     ││ ───────                                                     ││ None                                                        │├─────────────────────────────────────────────────────────────┤│ Summary: 1 critical, 2 high, 1 medium, 0 low                ││ Status: BLOCKING - Fix critical issues before release       │└─────────────────────────────────────────────────────────────┘
Fix the critical and high issues, then run:/security --verify

User: /security the payment processing code
Claude: Starting /security audit for payment code...
Phase 1: Security audit...[Spawns aegis]
┌─────────────────────────────────────────────────────────────┐│ Security Audit Report                                       │├─────────────────────────────────────────────────────────────┤│ Scope: src/services/payment/                                ││ Files scanned: 12                                           ││ Lines analyzed: 2,847                                       │├─────────────────────────────────────────────────────────────┤│ CRITICAL (1)                                                ││ ──────────                                                  ││ [C1] SQL Injection in payment.py:89                         ││      query = f"SELECT * FROM orders WHERE id = {order_id}"  ││      Fix: Use parameterized queries                         ││                                                             ││ HIGH (2)                                                    ││ ────────                                                    ││ [H1] Hardcoded API key in stripe_client.py:12               ││      STRIPE_KEY = "sk_live_..."                             ││      Fix: Move to environment variable                      ││                                                             ││ [H2] Missing input validation in refund.py:45               ││      amount = request.json['amount']  # No validation       ││      Fix: Validate amount is positive number                ││                                                             ││ MEDIUM (1)                                                  ││ ──────────                                                  ││ [M1] Verbose error messages in error_handler.py:23          ││      return {"error": str(e)}  # Leaks internal details     ││      Fix: Return generic message, log details internally    ││                                                             ││ LOW (0)                                                     ││ ───────                                                     ││ None                                                        │├─────────────────────────────────────────────────────────────┤│ Summary: 1 critical, 2 high, 1 medium, 0 low                ││ Status: BLOCKING - Fix critical issues before release       │└─────────────────────────────────────────────────────────────┘
Fix the critical and high issues, then run:/security --verify

After Fixes

User: /security --verify
Claude: Phase 2: Verifying fixes...[Spawns arbiter]
✅ C1: SQL injection fixed - using parameterized queries✅ H1: API key moved to environment variable✅ H2: Input validation added✅ M1: Error messages sanitized
All security tests passing.Security audit: PASSED

User: /security --verify
Claude: Phase 2: Verifying fixes...[Spawns arbiter]
✅ C1: SQL injection fixed - using parameterized queries✅ H1: API key moved to environment variable✅ H2: Input validation added✅ M1: Error messages sanitized
All security tests passing.Security audit: PASSED

OWASP Top 10 Coverage

Risk	Checked
A01 Broken Access Control	✅
A02 Cryptographic Failures	✅
A03 Injection	✅
A04 Insecure Design	✅
A05 Security Misconfiguration	✅
A06 Vulnerable Components	✅
A07 Auth Failures	✅
A08 Data Integrity Failures	✅
A09 Logging Failures	✅
A10 SSRF	✅

Flags

--deps: Dependencies only
--verify: Re-run after fixes
--owasp: Explicit OWASP Top 10 report
--secrets: Focus on secret detection

來源與署名

來源：parcadei/continuous-claude-v3位於.claude/skills/security提交d07ff4b

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Security

/security - Security Audit Workflow

When to Use

Workflow Overview

Agent Sequence

Why Dedicated Security?

Execution

Phase 1: Security Audit

Phase 2: Verification (After Fixes)

Security Scopes

Full Codebase

Specific Area

Single File

Dependencies Only

Example

After Fixes

OWASP Top 10 Coverage

Flags

來源與署名

更多來自 parcadei/continuous-claude-v3 的技能

Tldr Stats

Wiring

Workflow Router

Validate Agent

Tour

Tldr Overview

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt