Security Vulnerability Check
Use this skill when the task involves application security vulnerability checks for web apps, APIs, auth, data access, and secrets.
Goal: produce reliable engineering guidance and implementation steps focused on exploitable flaws, secure defaults, input validation, and sensitive data exposure.
Working model
- Identify the affected system, data, users, and failure modes.
- Define invariants, inputs, outputs, ownership, and rollback needs.
- Prefer small, auditable changes with explicit validation.
- Call out security, performance, concurrency, and data-loss risks when relevant.
- Finish with concrete verification steps and residual risks.
Rules
- Ground recommendations in the current codebase or runtime evidence.
- Prefer explicit contracts, typed boundaries, and defensive validation.
- Do not hide operational concerns behind generic best practices.
- Include negative cases, edge cases, and failure behavior.
- For review tasks, list findings first with file and line references when possible.
- For test or performance tasks, define the workload, success criteria, and measurement method.
Checklist
- Are assumptions and ownership boundaries explicit?
- Are risky changes reversible or safely deployable?
- Are observability and diagnostics sufficient for production issues?
- Are tests or validation steps targeted to the actual risk?
- Are security and data-integrity concerns addressed?
1---2name: security-vulnerability-check3description: Use when working on application security vulnerability checks for web apps, APIs, auth, data access, and secrets. Focus on exploitable flaws, secure defaults, input validation, and sensitive data exposure.4---56# Security Vulnerability Check78Use this skill when the task involves application security vulnerability checks for web apps, APIs, auth, data access, and secrets.910Goal: produce reliable engineering guidance and implementation steps focused on exploitable flaws, secure defaults, input validation, and sensitive data exposure.1112## Working model13141. Identify the affected system, data, users, and failure modes.152. Define invariants, inputs, outputs, ownership, and rollback needs.163. Prefer small, auditable changes with explicit validation.174. Call out security, performance, concurrency, and data-loss risks when relevant.185. Finish with concrete verification steps and residual risks.1920## Rules2122- Ground recommendations in the current codebase or runtime evidence.23- Prefer explicit contracts, typed boundaries, and defensive validation.24- Do not hide operational concerns behind generic best practices.25- Include negative cases, edge cases, and failure behavior.26- For review tasks, list findings first with file and line references when possible.27- For test or performance tasks, define the workload, success criteria, and measurement method.2829## Checklist3031- Are assumptions and ownership boundaries explicit?32- Are risky changes reversible or safely deployable?33- Are observability and diagnostics sufficient for production issues?34- Are tests or validation steps targeted to the actual risk?35- Are security and data-integrity concerns addressed?
mr-q526