verify-security

安全校验关卡。自动扫描代码安全漏洞，检测危险模式，确保安全决策有文档记录。当魔尊提到安全扫描、漏洞检测、安全审计、代码安全、OWASP、注入检测、敏感信息泄露时使用。在新建模块、安全相关变更、攻防任务、重构完成时自动触发。

155 stars

bytelagod

View on GitHub Installation ↓

Best use case

verify-security is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using verify-security should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/verify-security/SKILL.md --create-dirs "https://raw.githubusercontent.com/telagod/code-abyss/main/skills/tools/verify-security/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/verify-security/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How verify-security Compares

Feature / Agent	verify-security	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# 安全校验关卡

## 命令

```bash
node scripts/security_scanner.js <路径>
node scripts/security_scanner.js <路径> -v           # 详细
node scripts/security_scanner.js <路径> --json       # JSON
node scripts/security_scanner.js <路径> --exclude vendor
```

## 检测矩阵

| 类别 | 检测项 | 严重度 |
|------|--------|--------|
| 注入 | SQL/命令/代码注入 | Critical |
| 敏感信息 | 硬编码密钥、AWS Key、私钥 | Critical |
| XSS | innerHTML、dangerouslySetInnerHTML | High |
| 反序列化 | pickle.loads、yaml.load | High |
| 路径遍历 | 未验证文件路径操作 | High |
| SSRF | 未验证 URL 请求 | High |
| 弱加密 | MD5/SHA1 用于安全场景 | Medium |
| 不安全随机 | random 用于安全场景 | Medium |
| 调试残留 | console.log、debugger | Low |

## 危险模式速查

```python
# 危险: eval(), exec(), os.system(), subprocess(shell=True), pickle.loads(), yaml.load(), f"SELECT...{id}"
# 安全: ast.literal_eval(), subprocess([...], shell=False), yaml.safe_load(), cursor.execute("...%s", (id,))
```

```javascript
// 危险: eval(), innerHTML, document.write(), new Function(userInput)
// 安全: JSON.parse(), textContent, 模板引擎自动转义
```

```go
// 危险: exec.Command("sh", "-c", userInput), template.HTML(userInput)
// 安全: exec.Command("cmd", args...), html/template 自动转义
```

## 触发条件

新建模块 | 安全相关变更 | 攻防任务 | 重构完成 | 提交前

## 输出规则

Critical/High 必修后方可交付。安全决策须于 DESIGN.md 记录：威胁模型、信任边界、已知风险。