Security risk review
Skill ligyDt/ai-ide-init-template/codex/.agents/skills/security-risk-review
面向 Codex、Cursor、CodeBuddy、TRAE 的中文 AI IDE 项目初始化模板，内置多角色协作、Skills、MCP、Hooks 与安全验证。
npx -y skills add ligyDt/ai-ide-init-template --skill security-risk-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
审查凭据、隐私、外部访问、真实数据、支付、发布和生产操作风险。用于接入第三方系统、处理用户或业务敏感数据、使用自动化账号、建立支付能力、部署或执行任何高风险外部动作前。
SKILL.md
1.2 KB, 358 tokens by cl100k_base, as published. Nobody here has run it
安全风险审查
在高风险动作发生前识别阻断项与必须具备的控制措施。
流程
- 列出资产、数据类别、信任边界、参与系统、操作主体、目标环境和权限范围。
- 检查凭据获取与保存方式、最小权限、审计性、数据保留、脱敏和撤销能力。
- 将真实数据、生产读写、支付、账号自动化、公开发布、付费开通和基础设施变更视为需要明确批准的动作。
- 区分可在非生产只读验证的事项、必须增加控制后才可执行的事项，以及当前禁止的事项。
- 输出风险等级、控制要求、验收证据和阻断项。
输出
- 资产与信任边界
- 风险及影响
- 必需控制和批准条件
- 放行范围或阻断结论
停止条件
发现明文凭据、未经批准的生产或真实数据访问、真实支付或不可逆外部写入时，立即阻断并报告。
What ships with it: 1 file
236 B alongside SKILL.md
agents/
- openai.yaml236 B