inspect-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

inspect-security — Software Security & Threat Exposure Auditor

inspect-security — 软件安全与威胁暴露审计器

Domain Rubric

领域评估准则

1. Scope & Tolerability Guardrails (What to Ignore)

1. 范围与可容忍性护栏（应忽略的内容）

Mandatory Target Scope: The user MUST specify an explicit target path (
```
file
```
,
```
directory
```
, or
```
subsystem
```
). If no target scope is provided, halt turn immediately and prompt user:
```
"Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."
```
; forbid speculative full-repository scans.
Vulnerability Debt vs. Linter Nits: Confine analysis strictly to actionable threat exposure, broken authorization, cryptographic flaws, taint sinks, and concurrency races; defer basic AST formatting, syntax stylistic preferences, and whitespace entirely to native linters.
Governing Reference: Evaluate security patterns strictly against
```
references/security-rubric.md
```
.

强制目标范围：用户必须指定明确的目标路径（
```
file
```
、
```
directory
```
或
```
subsystem
```
）。如果未提供目标范围，立即停止当前轮次并提示用户："Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."；禁止推测性扫描整个代码仓库。
漏洞债务与 Linter 小问题：将分析严格限定于可执行的威胁暴露、授权失效、加密缺陷、taint sinks 和并发竞态；完全交由原生 linter 处理基础 AST 格式化、语法样式偏好和空白字符问题。
治理参考：严格按照
```
references/security-rubric.md
```
评估安全模式。

2. Decision Bifurcation: [LOCAL-FIX] vs. [ARCHITECTURAL-REFACTOR]

2. 决策分支：[LOCAL-FIX] 与 [ARCHITECTURAL-REFACTOR]

```
[LOCAL-FIX]
```
(Localized In-Function Patch): Parameterizing raw ORM queries, replacing
```
Math.random()
```
with CSPRNG, adding constant-time
```
timingSafeEqual
```
with pre-hashing, strict DTO schema whitelisting, wrapping streams in
```
io.LimitReader
```
, or pinning JWT algorithms. Route behavior-changing remediation to
```
/changeset
```
; use
```
/forge
```
only with a supported, authorized changeset.
```
[ARCHITECTURAL-REFACTOR]
```
(Systemic Structural Hardening): Introducing PostgreSQL Row-Level Security (RLS) for tenant isolation, deploying dedicated Egress Proxies (Smokescreen/Envoy) for SSRF mitigation, implementing Token Family refresh rotation with breach cascades, transitioning balance mutations to atomic conditional SQL / ledgers, or introducing distributed sliding-window rate limiting. Route remediation to
```
/changeset
```
.

```
[LOCAL-FIX]
```
（函数内局部补丁）：对原始 ORM 查询进行参数化处理、将
```
Math.random()
```
替换为 CSPRNG、添加带预哈希的恒定时间
```
timingSafeEqual
```
、实施严格的 DTO schema 白名单、使用
```
io.LimitReader
```
包装 stream，或固定 JWT 算法。将改变行为的修复交由
```
/changeset
```
；只有在存在受支持且已授权的 changeset 时，才使用
```
/forge
```
。
```
[ARCHITECTURAL-REFACTOR]
```
（系统性结构加固）：引入 PostgreSQL Row-Level Security (RLS) 以实现租户隔离，部署专用 Egress Proxies (Smokescreen/Envoy) 以缓解 SSRF，实现带泄露级联失效处理的 Token Family 刷新轮换，将余额变更操作迁移为原子条件 SQL / 账本，或引入分布式滑动窗口速率限制。将修复交由
```
/changeset
```
。

Canonical Output Contract

规范输出契约

markdown

undefined

markdown

undefined

Security Audit Dossier: <Target Scope>

1. Executive Summary

Target Inspected:
```
<directory_or_file_path>
```
Security Posture: <HARDENED | LOCALIZED_RISKS | CRITICAL_EXPOSURE>
Primary Threat Vector: <Single-sentence summary of highest-severity exploit scenario or systemic hazard>

Target Inspected:
```
<directory_or_file_path>
```
Security Posture: <HARDENED | LOCALIZED_RISKS | CRITICAL_EXPOSURE>
Primary Threat Vector: <Single-sentence summary of highest-severity exploit scenario or systemic hazard>

2. Load-Bearing Defect Catalog

[<CRITICAL | HIGH | MEDIUM>] [<LOCAL-FIX | ARCHITECTURAL-REFACTOR>] <Dimension>:

<Target Symbol / Route>

[<CRITICAL | HIGH | MEDIUM>] [<LOCAL-FIX | ARCHITECTURAL-REFACTOR>] <Dimension>:

<Target Symbol / Route>

Offending Code: <file>#L<N>
Violated Rubric: <spec_or_dimension>
Threat & Exploit Scenario: <Observable attack vector, failure mode, or privilege escalation scenario>
Action: <[LOCAL-FIX] Local patch OR [ARCHITECTURAL-REFACTOR] Systemic architecture hardening>

(Emit 'No load-bearing security defects observed across rubric dimensions' if clean)

undefined

Offending Code: <file>#L<N>
Violated Rubric: <spec_or_dimension>
Threat & Exploit Scenario: <Observable attack vector, failure mode, or privilege escalation scenario>
Action: <[LOCAL-FIX] Local patch OR [ARCHITECTURAL-REFACTOR] Systemic architecture hardening>

(Emit 'No load-bearing security defects observed across rubric dimensions' if clean)

undefined

Routing

路由

A supported changeset already authorizes the security fix and required verification → (via /forge).
Local or systemic security patches requiring scope staging, including authorization, crypto, or data-contract changes → (via /changeset).

已有受支持的 changeset 授权安全修复及所需验证 →（通过
```
/forge
```
）。
需要暂存变更范围的本地或系统性安全补丁，包括授权、加密或数据契约变更 →（通过
```
/changeset
```
）。

Execution Protocol

执行协议

Intake & Scope Gate:

Ingest target scope (
```
file
```
,
```
directory
```
, or
```
subsystem
```
).

Enforce Scope Gate: If no explicit scope is provided, halt turn immediately and prompt user:

"Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."

Read and ground in
```
references/security-rubric.md
```
.

Scale-Adaptive Pragmatic Audit:
- In-Turn Execution (< 10 files or cohesive module): Audit code directly in-turn against rubric dimensions.
- Subagent Fan-Out (broad multi-package subsystem): Launch concurrent
```
research
```
  subagents dynamically scaled to partitioned slices or caller-declared budget (Role:
```
Security Inspector (<Slice>)
```
  ) seeded with slice coordinates, discovered anchors, Domain Rubric, and Output Contract (offload extensive proof traces or PoCs to
```
.agents/scratch/security-<slice>-dossier.md
```
  ).
- Enforce Section 1 Guardrails: ignore stylistic noise; classify every finding explicitly as
```
[LOCAL-FIX]
```
  or
```
[ARCHITECTURAL-REFACTOR]
```
  .
Synthesis & Turn-Halt Gate:
- Consolidate findings into the Canonical Output Contract with pointers to any offloaded dossiers.
- Assign definitive Security Posture (
```
HARDENED
```
  ,
```
LOCALIZED_RISKS
```
  ,
```
CRITICAL_EXPOSURE
```
  ).
- Present completed dossier into conversation stream and halt turn immediately.

接收与范围门控：
- 接收目标范围（
```
file
```
  、
```
directory
```
  或
```
subsystem
```
  ）。
- 强制范围门控：如果未提供明确范围，立即停止当前轮次并提示用户："Vui lòng chỉ định rõ phạm vi kiểm tra (file, thư mục hoặc subsystem) khi sử dụng /inspect-security."
- 阅读并以
```
references/security-rubric.md
```
  为依据。
规模自适应的务实审计：
- 当前轮次执行（少于 10 个文件或内聚模块）：直接依据准则维度在当前轮次中审计代码。
- Subagent 扇出（广泛的 multi-package 子系统）：并发启动
```
research
```
  subagent，根据分区切片或调用方声明的预算动态调整规模（角色：
```
Security Inspector (<Slice>)
```
  ），并向其提供切片坐标、已发现的锚点、Domain Rubric 和 Output Contract（将大量证明追踪或 PoC 卸载至
```
.agents/scratch/security-<slice>-dossier.md
```
  ）。
- 执行第 1 节护栏：忽略样式噪声；将每项发现明确归类为
```
[LOCAL-FIX]
```
  或
```
[ARCHITECTURAL-REFACTOR]
```
  。
综合与轮次终止门控：
- 将各项发现整合到 Canonical Output Contract 中，并提供指向所有已外置 dossier 的指针。
- 明确判定最终 Security Posture（
```
HARDENED
```
  、
```
LOCALIZED_RISKS
```
  、
```
CRITICAL_EXPOSURE
```
  ）。
- 在对话流中呈现已完成的 dossier，并立即停止当前轮次。

inspect-security

Original

Translation

inspect-security — Software Security & Threat Exposure Auditor

inspect-security — 软件安全与威胁暴露审计器

Domain Rubric

领域评估准则

1. Scope & Tolerability Guardrails (What to Ignore)

1. 范围与可容忍性护栏（应忽略的内容）

2. Decision Bifurcation: [LOCAL-FIX] vs. [ARCHITECTURAL-REFACTOR]

2. 决策分支：[LOCAL-FIX] 与 [ARCHITECTURAL-REFACTOR]

Canonical Output Contract

规范输出契约

Security Audit Dossier: <Target Scope>

Security Audit Dossier: <Target Scope>

1. Executive Summary

1. Executive Summary

2. Load-Bearing Defect Catalog

2. Load-Bearing Defect Catalog

[<CRITICAL | HIGH | MEDIUM>] [<LOCAL-FIX | ARCHITECTURAL-REFACTOR>] <Dimension>:
`<Target Symbol / Route>`

[<CRITICAL | HIGH | MEDIUM>] [<LOCAL-FIX | ARCHITECTURAL-REFACTOR>] <Dimension>:
`<Target Symbol / Route>`

Routing

路由

Execution Protocol

执行协议