[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CDGQEPBF9BAHEVMDYWBJEA":3,"skill-same:01M6CDGQEPBF9BAHEVMDYWBJEA":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6CDGQEPBF9BAHEVMDYWBJEA","security-review",null,"Review a change, module, or surface for exploitable defects — trust boundaries, authn\u002Fauthz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.","codewhale-hq\u002FCodewhale","codewhale-hq","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F326694313?v=4","01M6CDD9D70AD3631SMRJ7REW4","Codewhale","01M6CDD9H0VAXYCB2NGGPZC16K",41176,"MIT","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fcrates\u002Fskills\u002Fassets\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"review","security","security review","when","code review","defects","for","module","trust","general","dependency","use","user","check","filesystem","model","vulnerability","risk","injection","network","compliance","audit","code","lint","change","2026-11-10 10:12:30",false,"---\nname: security-review\ndescription: Review a change, module, or surface for exploitable defects — trust boundaries, authn\u002Fauthz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.\ninvocation: model+user\n---\n\n# Security Review\n\nProduce findings a reviewer can verify, not a vibes pass. Every finding\nnames the file, the reachable path that makes it real, and the fix.\n\n## Scope the review first\n\n- **What is under review:** a diff, a module, a plugin bundle, a network\n  surface. Say the boundary out loud before reading.\n- **Trust boundaries:** where untrusted input enters (HTTP handlers, MCP\n  tool args, file parsers, CLI flags, env vars, rendered content) and where\n  authority is exercised (fs writes, network egress, process spawn,\n  credential reads, signing).\n- **Prerequisites:** a checked-out tree and the project's own test runner.\n  Ask for credentials only if a live path genuinely needs them; never read\n  secrets from the environment or keychain yourself.\n\n## Procedure\n\n1. **Map entry points and sinks.** `rg` for the handlers, deserializers,\n   and exec\u002Ffs\u002Fnet calls in scope. Follow data from entry to sink before\n   judging it.\n2. **Authn\u002Fauthz.** Every mutating or sensitive handler checks identity and\n   object-level authorization. Look for checks that exist on one path but\n   not its sibling, and for checks done on the client only.\n3. **Injection.** Command lines, SQL, template eval, shell expansion,\n   path joins under user influence, and markup that will render later —\n   including generated HTML\u002Fmarkdown that carries repo content into a\n   browser surface.\n4. **Secrets.** `rg` for token\u002Fkey\u002Fsecret patterns and `git log -p` the\n   diff for credentials. Also check what gets *logged* or embedded in\n   receipts, exports, or error messages.\n5. **Dependencies.** Run the project's audit gate if it exists\n   (`cargo audit`, `npm audit`, `osv-scanner`) — report versions and CVEs,\n   not \"deps look old\".\n6. **Denial and abuse paths.** Unbounded reads\u002Fallocations, missing\n   timeouts on network calls, resource leaks in error paths, retry storms.\n7. **Verify a finding before reporting it.** Trace the real call path or\n   write a minimal proof. A finding that \"looks suspicious\" but has no\n   reachable path is a note, not a finding.\n\n## Findings format\n\nFor each: severity (exploitability × impact), file:line, the reachable\npath, a one-paragraph explanation, and the fix. Order by severity. Then a\nshort \"checked and clean\" list naming what was audited and cleared — the\nscope statement means something only if the clear list is honest.\n\n## Recovery and limits\n\n- If you cannot prove reachability, downgrade the claim and say what\n  evidence is missing.\n- Do not claim a formal audit, certification, or absence of\n  vulnerabilities. This review finds defects; it does not prove none exist.\n- Never fix-and-stay-quiet on a security finding in someone else's in-flight\n  code — report it first.\n\n## Completion criteria\n\n- Every entry point in scope was traced to its sinks.\n- Findings carry file:line + reachability + fix; the clear list names what\n  was actually checked.\n- Severity ordering is defensible by exploitability, not by how loudly the\n  code smells.\n","# Security Review\n\nProduce findings a reviewer can verify, not a vibes pass. Every finding\nnames the file, the reachable path that makes it real, and the fix.\n\n## Scope the review first\n\n- **What is under review:** a diff, a module, a plugin bundle, a network\n  surface. Say the boundary out loud before reading.\n- **Trust boundaries:** where untrusted input enters (HTTP handlers, MCP\n  tool args, file parsers, CLI flags, env vars, rendered content) and where\n  authority is exercised (fs writes, network egress, process spawn,\n  credential reads, signing).\n- **Prerequisites:** a checked-out tree and the project's own test runner.\n  Ask for credentials only if a live path genuinely needs them; never read\n  secrets from the environment or keychain yourself.\n\n## Procedure\n\n1. **Map entry points and sinks.** `rg` for the handlers, deserializers,\n   and exec\u002Ffs\u002Fnet calls in scope. Follow data from entry to sink before\n   judging it.\n2. **Authn\u002Fauthz.** Every mutating or sensitive handler checks identity and\n   object-level authorization. Look for checks that exist on one path but\n   not its sibling, and for checks done on the client only.\n3. **Injection.** Command lines, SQL, template eval, shell expansion,\n   path joins under user influence, and markup that will render later —\n   including generated HTML\u002Fmarkdown that carries repo content into a\n   browser surface.\n4. **Secrets.** `rg` for token\u002Fkey\u002Fsecret patterns and `git log -p` the\n   diff for credentials. Also check what gets *logged* or embedded in\n   receipts, exports, or error messages.\n5. **Dependencies.** Run the project's audit gate if it exists\n   (`cargo audit`, `npm audit`, `osv-scanner`) — report versions and CVEs,\n   not \"deps look old\".\n6. **Denial and abuse paths.** Unbounded reads\u002Fallocations, missing\n   timeouts on network calls, resource leaks in error paths, retry storms.\n7. **Verify a finding before reporting it.** Trace the real call path or\n   write a minimal proof. A finding that \"looks suspicious\" but has no\n   reachable path is a note, not a finding.\n\n## Findings format\n\nFor each: severity (exploitability × impact), file:line, the reachable\npath, a one-paragraph explanation, and the fix. Order by severity. Then a\nshort \"checked and clean\" list naming what was audited and cleared — the\nscope statement means something only if the clear list is honest.\n\n## Recovery and limits\n\n- If you cannot prove reachability, downgrade the claim and say what\n  evidence is missing.\n- Do not claim a formal audit, certification, or absence of\n  vulnerabilities. This review finds defects; it does not prove none exist.\n- Never fix-and-stay-quiet on a security finding in someone else's in-flight\n  code — report it first.\n\n## Completion criteria\n\n- Every entry point in scope was traced to its sinks.\n- Findings carry file:line + reachability + fix; the clear list names what\n  was actually checked.\n- Severity ordering is defensible by exploitability, not by how loudly the\n  code smells.\n",{"name":5,"invocation":54,"description":7},"model+user","main","654aa776d6bcb98292d4c7c5841fed871e1ba5bd","crates\u002Fskills\u002Fassets\u002Fskills\u002Fsecurity-review",3571,"https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale","https:\u002F\u002Fcodewhale.net\u002F","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq","https:\u002F\u002Fcodewhale.net","Open-source coding agent for your terminal. Works with the model provider you choose.","2026-11-12 02:35:28",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add codewhale-hq\u002FCodewhale --skill security-review",{"tool":71,"command":72},"bunx","bunx skills add codewhale-hq\u002FCodewhale --skill security-review",{"tool":74,"command":75},"pnpm","pnpm dlx skills add codewhale-hq\u002FCodewhale --skill security-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fcrates\u002Fskills\u002Fassets\u002Fskills\u002Fsecurity-review\u002FSKILL.md",true,[],[80,106,131,151,164,171],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":49},"01M6CDJRMPR8FX1WVFP94PGDMD","gh-find-prs","Survey the open Codewhale PR and issue queue read-only: fetch each item, check it against current code, and produce one coverage and disposition matrix with cited evidence and credit owed.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Fgh-find-prs\u002FSKILL.md",[],[87,88,89,90,91,92,93,94,95,96,97,98,37,46,99,100,101,102,103,104,105],"find","gh find prs","gh","prs","produce","with","read-only","matrix","codewhale","queue","issue","read","only","open","survey","pr","evidence","fetch","coverage",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":49},"01M6CDJP0ZYMQNA6AN028X7A96","gh-file-issue","Use when filing a new Codewhale GitHub issue: turn a bug or idea into a well-formed, actionable issue with repro, acceptance criteria, labels, and milestone.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Fgh-file-issue\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[116,89,117,118,97,119,120,121,27,122,123,124,125,95,126,127,128,92,129,130,35],"file issue","file","gh file issue","milestone","idea","filing","new","labels","acceptance","actionable","bug","github issue","github","acceptance criteria","repro",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":49},"01M6CDJJZB0G4XHWWBD12S990C","gh-close-issues","Close resolved Codewhale issues only after verifying the landed behavior: Refs #N per landing, Fixes #N only when the reporter's scenario was reproduced, closure at the release step or on the reporter's confirmation, always with a crediting comment.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Fgh-close-issues\u002FSKILL.md",[137],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,89,142,143,144,145,92,27,146,147,95,148,149,99,150],"gh close issues","close","issues","at","release","reporter","scenario","closure","fixes","behavior","confirmation","landing",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":49},"01M6CDJGR688JJVTG0A1ETBJGQ","gh-assign-issues","Use to assign GitHub issues to a milestone and\u002For owners in bulk, verifying each.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Fgh-assign-issues\u002FSKILL.md",[157],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},[159,89,141,160,35,128,119,161,162,163],"gh assign issues","assign","bulk","github issues","owners",{"skillNo":165,"name":166,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":49},"01M6CDJEBMKBAGTBG18N5YJNSE","feedback","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Ffeedback\u002FSKILL.md",[169],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},[166],{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":49},"01M6CDJBRQ86PP9XNXQMRB1CGX","cw-slice","Use before writing code for any Codewhale feature, upgrade, or refactor: find the existing owner of the behavior, bound the change to one reviewable slice, and fix the evidence bar before you start.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002FCodewhale\u002Fblob\u002Fmain\u002Fdocs\u002Fskills\u002Fcw-slice\u002FSKILL.md",[177],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},[179,180,181,182,183,184,185,30,186,95,187,148,87,48,46,35,188,189,103],"slice","cw slice","start","bar","you","Existing","upgrade","feature","refactor","writing","fix"]