security-review · GitHub
Revue de sécurité
Suit les frontières de confiance et les flux de données risqués dans le code.
Instructions originales de la skill
Le modèle technique reste en anglais afin de fonctionner directement avec les agents compatibles. Les explications, critères de choix et vérifications sont localisés.
Installation
gh skills install github/awesome-copilot security-review
GitHub CLI
Idéal pour
- Pre-merge security review
- Auth and permission changes
- Input, secret, and data-flow analysis
Ce que la skill apporte
- Reasons across components and follows untrusted input toward sensitive operations.
- Looks for authorization, secret handling, injection, and unsafe boundary assumptions.
- Produces review findings that can be checked against the actual implementation.
Workflow conseillé
- Map entry points, trust boundaries, sensitive data, and privileged operations.
- Trace realistic attacker-controlled inputs through the implementation.
- Rank findings by evidence and impact, then recommend testable remediations.
Points à vérifier avant validation
- An agent review is not a substitute for threat modeling or professional assessment.
- Validate every finding; both false positives and missed vulnerabilities are possible.
- Do not expose secrets, production data, or private code to an unauthorized model.