security-review · GitHub
安全审查 Skill
沿着代码中的信任边界和高风险数据流完成系统检查。
Skill 原始技术说明
技术模板保留英文，便于直接用于兼容的编程 Agent；页面说明、选型建议和检查步骤均已中文本地化。
安装方式
gh skills install github/awesome-copilot security-review
GitHub CLI
适合场景
- Pre-merge security review
- Auth and permission changes
- Input, secret, and data-flow analysis
这个 Skill 能做什么
- Reasons across components and follows untrusted input toward sensitive operations.
- Looks for authorization, secret handling, injection, and unsafe boundary assumptions.
- Produces review findings that can be checked against the actual implementation.
推荐工作流程
- Map entry points, trust boundaries, sensitive data, and privileged operations.
- Trace realistic attacker-controlled inputs through the implementation.
- Rank findings by evidence and impact, then recommend testable remediations.
使用前需要检查
- An agent review is not a substitute for threat modeling or professional assessment.
- Validate every finding; both false positives and missed vulnerabilities are possible.
- Do not expose secrets, production data, or private code to an unauthorized model.