Results for “safety-reliability”

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Enforces output quality, intellectual honesty, and continuous improvement across security analysis agents with anti-rationalization guards, self-critique loops, retry protocols, and quality gates.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Triages security incidents by classifying type, assigning severity based on business impact, enriching with threat intelligence, and routing to appropriate response teams using NIST SP 800-61r3 and SANS PICERL frameworks.

Use this when reviewing a feature, service, API, auth design, integration, job system, or deployment plan for security weaknesses, unsafe trust assumptions, input risks, or privilege issues.

Audit Solidity smart contracts for reentrancy, oracle manipulation, token decimals, SafeERC20, ERC-4626 inflation, infinite approvals, and MEV vulnerabilities with a pre-deployment checklist.

Resolves legacy references to the security-reviewer capability and routes to the current runtime implementation.

Routes ambiguous security work to one leaf skill. Do not use when a specific security review or fix is already clear.

Guidance on security analysis, compliance auditing, and vulnerability assessment techniques relevant to legal and regulatory compliance tasks

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Security Craft

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Assesses a project against all five SOC 2 Trust Service Criteria, producing a control-by-control PASS/PARTIAL/FAIL matrix with evidence references, remediation roadmap, and evidence collection checklist for audit readiness.

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Code review guidelines covering code quality, security, and best practices.

Reviews code, diffs, or PRs for correctness, regressions, security, architecture, maintainability, and test gaps.

Perform language and framework-specific security best-practice reviews, write secure-by-default code, and generate prioritized vulnerability reports with suggested fixes.

Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I/O

Routes security requests to specialist skills and performs STRIDE/DREAD threat modeling with a quick secret scan.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Reviews code for objective correctness, security, and reliability.

Security Review

Use this skill for auth boundaries, input validation, secrets, RLS, injection risks, destructive-action review. Trigger when the task involves security work related to Security Hardening, production implementation, audits, debugging, strategy, or validation.

安全专家入口。用于 Codex CLI 的 $expert-security 调用。 适用于威胁建模、漏洞评估、安全代码审查、安全架构设计、DevSecOps、安全运营、事件响应、合规审计和完整安全健康评估。 触发词：安全专家、威胁建模、STRIDE、OWASP、SAST、DAST、SBOM、漏洞评估、代码审计、事件响应、合规审计、SOC、等保、GDPR、PIPL、隐私政策审查

Laravel 安全最佳实践，涵盖认证/授权、验证、CSRF、批量赋值、文件上传、密钥、速率限制和安全部署。