security-review

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use for a full codebase security review with prioritized findings, remediation guidance, and a formal report.

Target repository path (first argument after invocation).
- Example:
```
$security-review /path/to/repo
```
Security knowledge base source:
- Rules are sourced from Project CodeGuard, an open-source, model-agnostic security framework by CoSAI/OASIS.

If the repo path is missing or unclear, ask the user for it before proceeding.

如果仓库路径缺失或不明确，请在开始前向用户确认。

Load the security knowledge base from Project CodeGuard
- First read the
```
Security_Code_Reviewer_Guidelines.md
```
  file bundled with this skill. Use its purpose and rule-loading strategy to guide the review.
- Load all core security rules from Project CodeGuard:
  text
```
https://github.com/cosai-oasis/project-codeguard/tree/main/sources/core
```
  These are mandatory foundational rules that must be loaded for every review.
- Load relevant OWASP rules for the detected tech stack from:
  text
```
https://github.com/cosai-oasis/project-codeguard/tree/main/sources/owasp
```
  Only load OWASP rules that match the target repository's technology stack.
Perform deep code analysis
- Review the repository line by line.
- Focus on: injection flaws, authn/authz, hardcoded secrets, crypto misuse, SSRF, path traversal, RCE vectors, XSS/CSRF, unsafe deserialization, insecure defaults/configuration, and supply chain issues.
Produce the report in markdown.

从Project CodeGuard加载安全知识库
- 首先读取此技能附带的
```
Security_Code_Reviewer_Guidelines.md
```
  文件，以其目标和规则加载策略指导审查工作。
- 从Project CodeGuard加载所有核心安全规则：
  text
```
https://github.com/cosai-oasis/project-codeguard/tree/main/sources/core
```
  这些是每次审查都必须加载的强制基础规则。
- 从以下路径加载与检测到的技术栈相关的OWASP规则：
  text
```
https://github.com/cosai-oasis/project-codeguard/tree/main/sources/owasp
```
  仅加载与目标代码仓库技术栈匹配的OWASP规则。
执行深度代码分析
- 逐行审查代码仓库。
- 重点关注：注入漏洞、身份验证/授权、硬编码密钥、加密误用、SSRF、路径遍历、RCE攻击向量、XSS/CSRF、不安全反序列化、不安全默认配置以及供应链问题。
生成Markdown格式的报告。

Executive Summary
- Total findings by severity (Critical/High/Medium/Low/Info)
- Top 5 most critical issues
- Overall security posture
Detailed Findings (for each issue)
- Title, Severity, Rule Reference(s), Location, Code Snippet
- Description, Impact, Remediation (with examples), References
Findings by Category
Recommendations
- Immediate actions, short-term (1-3 months), long-term improvements, tooling/process suggestions
Appendix
- Files reviewed, rules applied/coverage, methodology notes