cybersecurity-review

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: cybersecurity-review
description: >
  Perform comprehensive cybersecurity code review across 9 security dimensions:
  injection prevention, authentication/authorization, secrets management,
  supply chain security (including CI/CD pipeline integrity), cryptography,
  secure configuration/API security (including SSRF), error handling/logging/resource safety,
  LLM/AI application security, and infrastructure/API protocol security (GraphQL, Kubernetes,
  WebSockets, OAuth 2.0, gRPC). Use when reviewing newly written code,
  auditing existing repositories, evaluating open source projects, or assessing
  pull requests for security vulnerabilities. Triggers include requests like
  "security review", "check for vulnerabilities", "audit this code",
  "cybersecurity review", "is this code secure", or "check this PR for security issues".
license: MIT
---

# Cybersecurity Review

Perform structured security code review across 9 dimensions, adapting depth based on review mode.

## Review Modes

Select the appropriate mode based on context:

| Mode | Trigger | Scope | Depth |
|------|---------|-------|-------|
| **New Code** | Reviewing code just written or a new feature | Changed files only | Deep on all 9 dimensions |
| **Existing Repo** | Auditing an established codebase | Full repository scan | Prioritize high-severity, sample for depth |
| **Open Source Eval** | Evaluating a dependency or OSS project | Full project + community signals | Supply chain focus + all 9 dimensions |
| **Pull Request** | Reviewing a PR for merge readiness | Diff only + touched files | Deep on changed code, contextual on surrounding code |

## Review Workflow

### Step 1: Determine scope and mode

Identify which review mode applies. For PR reviews, obtain the diff. For repo audits, identify primary languages and frameworks.

### Step 2: Run through each applicable dimension

Load the relevant reference file for each dimension and assess the code:

1. **Input Validation & Injection Prevention** -- See [references/injection-prevention.md](references/injection-prevention.md)
   - SQL injection, XSS, command injection, path traversal, deserialization, SSTI, XXE

2. **Authentication & Authorization** -- See [references/auth-and-access-control.md](references/auth-and-access-control.md)
   - Broken auth, IDOR, privilege escalation, session management, JWT misuse

3. **Secrets & Credential Management** -- See [references/secrets-management.md](references/secrets-management.md)
   - Hardcoded secrets, API keys in source, committed .env files, missing secret scanning

4. **Dependency & Supply Chain Security** -- See [references/supply-chain-security.md](references/supply-chain-security.md)
   - Vulnerable dependencies, typosquatting, dependency confusion, lockfile integrity, CI/CD pipeline integrity, GitHub Actions SHA pinning

5. **Cryptography & Data Protection** -- See [references/cryptography.md](references/cryptography.md)
   - Weak algorithms, insecure random, hardcoded keys, missing TLS, poor password hashing

6. **Secure Configuration & API Security** -- See [references/config-and-api-security.md](references/config-and-api-security.md)
   - Debug mode, permissive CORS, missing security headers, BOLA, mass assignment, rate limiting, SSRF kill-chain patterns

7. **Error Handling, Logging & Resource Safety** -- See [references/error-logging-resources.md](references/error-logging-resources.md)
   - Stack trace exposure, sensitive data in logs, log injection, ReDoS, buffer overflows, TOCTOU, mishandling exceptional conditions

8. **LLM & AI Application Security** -- See [references/llm-ai-security.md](references/llm-ai-security.md)
   - Prompt injection (direct and indirect/RAG), improper LLM output handling, excessive agency, system prompt leakage, AI supply chain

9. **Infrastructure & API Protocol Security** -- See [references/infra-and-protocol-security.md](references/infra-and-protocol-security.md)
   - GraphQL (introspection, depth/complexity, batchin