security-audit

This skill guides you through performing comprehensive security audits on codebases to identify vulnerabilities, insecure patterns, and configuration issues. Use this when conducting security reviews, preparing for production deployments, or responding to security incidents.

Objective: Understand the application architecture, tech stack, and attack surface.

Best practice: Use crypto.timingSafeEqual() for comparing webhook signatures to prevent timing attacks:

当任务涉及安全审查、漏洞评估或强化时主动加载。当用户说“检查安全问题”、“审核漏洞”、“扫描机密”、“检查身份验证安全性”或“检查 OWASP 合规性”时使用。涵盖身份验证和会话安全、授权和访问控制、输入验证和注入预防、数据保护和加密、依赖项漏洞扫描、API 安全（CORS、速率限制、标头）和基础设施强化。生成带有严重性评级的结构化报告。 来源：mgd34msu/goodvibes-plugin。