security-guardian

Security Guardian Skill (安全守护技能)

Capabilities (能力)

• Secrets scanning: Identify hardcoded API Keys, Tokens, and passwords.
• Injection detection: Identify potential SQL injection and XSS risks.
• Privilege escalation detection: Check whether APIs lack necessary Session validation or role validation.
• Dependency audit: Check package.json for insecure packages.

Instructions (指令)

1. Mandatory audit: When server/api changes are involved, the calls to server/utils/permission.ts must be checked.
2. Sensitive operation control: Perform dual auditing for deletion and sensitive data update operations.
3. Uncertainty reporting: If it cannot be determined whether a piece of logic is safe, the user must be prompted to manually verify it.

Usage Example (使用示例)

Input: "Review this login logic." Action: Check whether secure hashing is used, whether there is rate limiting, and whether passwords are output in logs.