用途分类 / 开发辅助
Code Review Excellence Skill 安全审计
作者说它能做什么（原文）
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.
第三方安全检查结论
这次检查未发现明显风险
- 已检查文件
- 1
- 发现的风险
- 0
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险
Skill 逻辑拆解
该 Skill 是代码审查方法指南，适用于审查代码变更、制定团队审查标准和辅导开发者；其声明目标是发现缺陷、改善可维护性、共享知识并执行编码标准。
查看原文
- Reviewing pull requests and code changes- Establishing code review standards for teams- Mentoring junior developers through reviews- Conducting architecture reviews- Creating review checklists and guidelines- Improving team collaboration- Catch bugs and edge cases- Ensure code maintainability- Share knowledge across team- Enforce coding standards- Improve design and architecture- Build team culture其工作流程要求先阅读 PR 描述、关联问题、CI 状态和业务需求，再检查架构、测试、逐行逻辑、安全、性能与可维护性，最后给出批准、评论或要求修改的结论。
查看原文
1. Read PR description and linked issue2. Check PR size (>400 lines? Ask to split)3. Review CI/CD status (tests passing?)4. Understand the business requirement5. Note any relevant architectural decisions```1. **Logic & Correctness** - Edge cases handled? - Off-by-one errors? - Null/undefined checks? - Race conditions?2. **Security** - Input validation? - SQL injection risks? - XSS vulnerabilities? - Sensitive data exposure?3. **Performance** - N+1 queries? - Unnecessary loops? - Memory leaks? - Blocking operations?```markdown1. Summarize key concerns2. Highlight what you liked3. Make clear decision: - ✅ Approve - 💬 Comment (minor suggestions) - 🔄 Request Changes (must address)4. Offer to pair if complex```该 Skill 提供安全审查清单，覆盖认证与授权、密钥保护、输入和文件上传限制、SQL 注入、XSS、敏感数据保护、动态执行、CSRF 与速率限制。
查看原文
### Authentication & Authorization- [ ] Is authentication required where needed?- [ ] Are authorization checks before every action?- [ ] Is JWT validation proper (signature, expiry)?- [ ] Are API keys/secrets properly secured?### Input Validation- [ ] All user inputs validated?- [ ] File uploads restricted (size, type)?- [ ] SQL queries parameterized?- [ ] XSS protection (escape output)?### Data Protection- [ ] Passwords hashed (bcrypt/argon2)?- [ ] Sensitive data encrypted at rest?- [ ] HTTPS enforced for sensitive data?- [ ] PII handled according to regulations?### Common Vulnerabilities- [ ] No eval() or similar dynamic execution?- [ ] No hardcoded secrets?- [ ] CSRF protection for state-changing operations?- [ ] Rate limiting on public endpoints?```所提供内容是说明、清单、评论模板及标明正误的示例；可见源码没有安装步骤、命令执行指令、凭据请求、数据上传指令或自动修改文件的实现。
查看原文
```markdown## Summary[Brief overview of what was reviewed]## Strengths- [What was done well]- [Good patterns or approaches]## Required Changes🔴 [Blocking issue 1]🔴 [Blocking issue 2]## Suggestions💡 [Improvement 1]💡 [Improvement 2]## Questions❓ [Clarification needed on X]❓ [Alternative approach consideration]## Verdict✅ Approve after addressing required changes```从这里开始 · 工作说明SKILL.md
code-review-excellence文件与检查记录1 个文件
检查范围与遗漏
逐文件查看涉及的内容
下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。
SKILL.md已纳入全文
这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。
SKILL.md工作说明
代码和说明中提到的操作
连接外部网站
async function fetchUser(id: string) { const response = await fetch(`/api/users/${id}`); return response.json(); // What if network fails? try { const response = await fetch(`/api/users/${id}`); if (!response.ok) {- 读取了多少行
- 530
- 文件校验值（用于核对版本）
- 5ddb61d462e19129db555ace045777234b1467f851c5bee21a26ec45b6386983