security
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseSecurity
安全
Read first. This skill adds security-specific guidance.
AGENTS.md请先阅读。本技能提供安全专项指导。
AGENTS.mdDefault Stance
默认立场
- prioritize realistic attacker goals and concrete impact
- ground claims in actual code, entrypoints, data flows, and deployment shape
- prefer secure defaults that do not silently break intended behavior
- 优先关注真实攻击者目标及具体影响
- 所有论断需基于实际代码、入口点、数据流与部署形态
- 优先采用不会静默破坏预期行为的安全默认配置
Threat-Model Workflow
威胁建模工作流
- Identify components, entrypoints, trust boundaries, assets, and attacker goals.
- Separate runtime behavior from build/test/dev tooling.
- Enumerate a small set of high-quality abuse paths.
- Rank findings by likelihood and impact with explicit assumptions.
- Recommend mitigations tied to concrete boundaries or components.
- 识别组件、入口点、信任边界、资产与攻击者目标。
- 区分运行时行为与构建/测试/开发工具链。
- 枚举少量高质量的滥用路径。
- 基于明确假设，按发生概率与影响对发现的问题进行排序。
- 给出与具体边界或组件绑定的缓解方案建议。
Secure-Review Workflow
安全审查工作流
When reviewing code for security:
- look for auth/authz gaps, unsafe parsing, command execution, path traversal, injection, secrets exposure, weak validation, and denial-of-service risks
- note where types/contracts could make misuse harder
- distinguish critical findings from hygiene improvements
开展代码安全审查时：
- 排查认证/授权缺口、不安全解析、命令执行、路径遍历、注入攻击、凭证泄露、弱校验及拒绝服务风险
- 标注可提升误用成本的类型/契约位置
- 区分严重问题与规范性优化项
Reporting Rules
报告规则
- findings first, ordered by severity
- include concrete file references and impacted asset/boundary
- make assumptions explicit
- avoid generic checklist noise when the repo evidence does not support it
- 优先呈现发现的问题，按严重程度排序
- 包含具体的文件引用及受影响的资产/边界
- 明确列出假设前提
- 若仓库证据不支持，避免使用通用checklist类的无效内容