security-audit

This skill guides you through performing comprehensive security audits on codebases to identify vulnerabilities, insecure patterns, and configuration issues. Use this when conducting security reviews, preparing for production deployments, or responding to security incidents.

Objective: Understand the application architecture, tech stack, and attack surface.

Best practice: Use crypto.timingSafeEqual() for comparing webhook signatures to prevent timing attacks:

當任務涉及安全審查、漏洞評估或強化時主動載入。當使用者說「檢查安全性問題」、「審核漏洞」、「掃描機密」、「檢查身份驗證安全性」或「檢查 OWASP 合規性」時使用。涵蓋身份驗證和會話安全性、授權和存取控制、輸入驗證和注入預防、資料保護和加密、依賴項漏洞掃描、API 安全（CORS、速率限制、標頭）和基礎設施強化。產生帶有嚴重性評級的結構化報告。 來源：mgd34msu/goodvibes-plugin。