Back to Details

verify-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Verification

安全验证

Purpose

目的

Verify code for security anti-patterns and vulnerabilities. All analysis happens locally—code never leaves your machine.
检查代码中的安全反模式与漏洞。所有分析均在本地进行——代码绝不会离开你的设备。

When to Use

适用场景

Trigger this skill when the user asks to:
  • "verify agent security"
  • "verify security"
  • "check for secrets"
  • "scan for vulnerabilities"
  • "security audit"
Note: For full verification including patterns, quality, and language-specific checks, tell the user to say "verify agent".
当用户提出以下请求时触发此技能：
  • "verify agent security"
  • "验证安全性"
  • "检查密钥"
  • "扫描漏洞"
  • "安全审计"
注意： 若需包含模式、质量及特定语言检查的完整验证，请告知用户说出 "verify agent"。

Process

流程

Step 1: Discover Files

步骤1：发现文件

Locate files to analyze:
Configuration files:
  • package.json
    , 
    pyproject.toml
    , 
    Cargo.toml
    - Dependencies
  • .env
    , 
    .env.example
    , 
    .env.local
    - Environment files
  • config.py
    , 
    settings.py
    , 
    config.ts
    - Configuration
Source files:
  • *.py
    , 
    *.ts
    , 
    *.js
    , 
    *.go
    , 
    *.rs
    - Source code
  • Prioritize files with: 
    auth
    , 
    api
    , 
    client
    , 
    secret
    , 
    config
    in name
Exclude:
  • node_modules/
    , 
    .venv/
    , 
    venv/
    , 
    __pycache__/
  • *.test.*
    , 
    *.spec.*
    , 
    *_test.go
定位待分析的文件：
配置文件：
  • package.json
    , 
    pyproject.toml
    , 
    Cargo.toml
    - 依赖项
  • .env
    , 
    .env.example
    , 
    .env.local
    - 环境文件
  • config.py
    , 
    settings.py
    , 
    config.ts
    - 配置文件
源代码文件：
  • *.py
    , 
    *.ts
    , 
    *.js
    , 
    *.go
    , 
    *.rs
    - 源代码
  • 优先处理名称包含 
    auth
    、
    api
    、
    client
    、
    secret
    、
    config
    的文件
排除文件：
  • node_modules/
    , 
    .venv/
    , 
    venv/
    , 
    __pycache__/
  • *.test.*
    , 
    *.spec.*
    , 
    *_test.go

Step 2: Run Security Checks

步骤2：执行安全检查

Check Tiers

检查层级

  • [PATTERN]
     — Mechanical check. Apply exactly as written.
  • [HEURISTIC]
     — Judgment required. Mark findings clearly.
Tag every finding with 
[P]
for pattern or 
[H]
for heuristic.
  • [PATTERN]
     —— 机械检查。严格按照规则执行。
  • [HEURISTIC]
     —— 需要判断。清晰标记检查结果。
为每个检查结果标记 
[P]
（模式匹配）或 
[H]
（启发式判断）。

2.1 
[PATTERN]
Hardcoded Secrets

2.1 
[PATTERN]
硬编码密钥

Scan for assignments matching these patterns (case-insensitive):
Variable patternFail condition
API_KEY
Assigned to string literal
SECRET
Assigned to string literal
PASSWORD
Assigned to string literal
TOKEN
Assigned to string literal
PRIVATE_KEY
Assigned to string literal
AWS_ACCESS_KEY_ID
Assigned to string literal
AWS_SECRET_ACCESS_KEY
Assigned to string literal
Examples of failures:
python
undefined
扫描符合以下模式的赋值语句（不区分大小写）：
变量模式失败条件
API_KEY
被赋值为字符串字面量
SECRET
被赋值为字符串字面量
PASSWORD
被赋值为字符串字面量
TOKEN
被赋值为字符串字面量
PRIVATE_KEY
被赋值为字符串字面量
AWS_ACCESS_KEY_ID
被赋值为字符串字面量
AWS_SECRET_ACCESS_KEY
被赋值为字符串字面量
失败示例：
python
undefined

❌ Issue

❌ 问题

API_KEY = "sk-abc123..." password = "hunter2" OPENAI_API_KEY = "sk-proj-..."
API_KEY = "sk-abc123..." password = "hunter2" OPENAI_API_KEY = "sk-proj-..."

✅ Pass

✅ 通过

API_KEY = os.environ["API_KEY"] password = os.getenv("PASSWORD") api_key = settings.API_KEY

**Also flag:**
- String literals matching known API key patterns:
  - `sk-...` (OpenAI)
  - `sk-ant-...` (Anthropic)
  - `AKIA...` (AWS)
  - `ghp_...` (GitHub)
  - `xoxb-...` (Slack)

Severity: ❌ Issue

---
API_KEY = os.environ["API_KEY"] password = os.getenv("PASSWORD") api_key = settings.API_KEY

**同时标记：**
- 匹配已知API密钥模式的字符串字面量：
  - `sk-...` (OpenAI)
  - `sk-ant-...` (Anthropic)
  - `AKIA...` (AWS)
  - `ghp_...` (GitHub)
  - `xoxb-...` (Slack)

严重程度：❌ 问题

---

2.2 
[PATTERN]
Dependency Version Pinning

2.2 
[PATTERN]
依赖项版本锁定

Python (
requirements.txt
):
PatternSeverity
package>=1.0
❌ Issue
package>1.0
❌ Issue
package
(no version)		❌ Issue
package==1.0.0
✅ Pass
package~=1.0
✅ Pass
Python (
pyproject.toml
):
Check 
[project.dependencies]
and 
[tool.poetry.dependencies]
:
  • Unpinned or 
    >=
    versions → ❌ Issue
  • Pinned with 
    ==
    or 
    ^
    or 
    ~
    → ✅ Pass
JavaScript/TypeScript (
package.json
):
PatternSeverity
"package": "*"
❌ Issue
"package": "latest"
❌ Issue
"package": ">=1.0.0"
⚠️ Warning
"package": "^1.0.0"
✅ Pass
"package": "~1.0.0"
✅ Pass
"package": "1.0.0"
✅ Pass
Python (
requirements.txt
)：
模式严重程度
package>=1.0
❌ 问题
package>1.0
❌ 问题
package
（无版本）		❌ 问题
package==1.0.0
✅ 通过
package~=1.0
✅ 通过
Python (
pyproject.toml
)：
检查 
[project.dependencies]
和 
[tool.poetry.dependencies]
：
  • 未锁定或使用 
    >=
    版本 → ❌ 问题
  • 使用 
    ==
    、
    ^
    或 
    ~
    锁定版本 → ✅ 通过
JavaScript/TypeScript (
package.json
)：
模式严重程度
"package": "*"
❌ 问题
"package": "latest"
❌ 问题
"package": ">=1.0.0"
⚠️ 警告
"package": "^1.0.0"
✅ 通过
"package": "~1.0.0"
✅ 通过
"package": "1.0.0"
✅ 通过

2.3 
[HEURISTIC]
Input Validation

2.3 
[HEURISTIC]
输入验证

Check for external data handling:
Look for:
  • HTTP request handlers (
    @app.route
    , 
    router.get
    , etc.)
  • User input processing (
    request.body
    , 
    req.params
    , 
    input()
    )
  • File uploads
  • Database queries with user input
Flag if:
  • User input is passed directly to database queries without sanitization
  • File paths are constructed from user input without validation
  • JSON parsing without schema validation on external data
Severity: ⚠️ Warning
Example patterns to flag:
python
undefined
检查外部数据处理逻辑：
关注内容：
  • HTTP请求处理器（
    @app.route
    、
    router.get
    等）
  • 用户输入处理（
    request.body
    、
    req.params
    、
    input()
    ）
  • 文件上传
  • 包含用户输入的数据库查询
标记情况：
  • 用户输入未经清理直接传入数据库查询
  • 使用用户输入构造文件路径但未验证
  • 对外部数据进行JSON解析但未做 schema 验证
严重程度：⚠️ 警告
需标记的模式示例：
python
undefined

⚠️ Warning - SQL without parameterization

⚠️ 警告 - SQL未参数化

query = f"SELECT * FROM users WHERE id = {user_id}"
query = f"SELECT * FROM users WHERE id = {user_id}"

⚠️ Warning - Path traversal risk

⚠️ 警告 - 存在路径遍历风险

file_path = os.path.join(base_dir, user_filename)
file_path = os.path.join(base_dir, user_filename)

✅ Pass - Parameterized query

✅ 通过 - 参数化查询

cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

---
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

---

2.4 
[HEURISTIC]
Error Message Exposure

2.4 
[HEURISTIC]
错误信息暴露

Check error handling for information leakage:
Flag if:
  • Stack traces returned in HTTP responses
  • Database error messages exposed to users
  • Internal paths or system info in error messages
  • Debug mode enabled in production code
Look for:
python
undefined
检查错误处理是否存在信息泄露：
标记情况：
  • HTTP响应中返回堆栈跟踪
  • 向用户暴露数据库错误信息
  • 错误信息中包含内部路径或系统信息
  • 生产代码中启用调试模式
关注内容：
python
undefined

⚠️ Warning

⚠️ 警告

except Exception as e: return {"error": str(e)} # Exposes internal details
except Exception as e: return {"error": str(e)} # 暴露内部细节

⚠️ Warning

⚠️ 警告

app = Flask(name) app.debug = True # Debug in production
app = Flask(name) app.debug = True # 生产环境启用调试

✅ Pass

✅ 通过

except Exception as e: logger.error(f"Error: {e}") return {"error": "An error occurred"}

Severity: ⚠️ Warning

---
except Exception as e: logger.error(f"Error: {e}") return {"error": "An error occurred"}

严重程度：⚠️ 警告

---

2.5 
[HEURISTIC]
Secure Defaults

2.5 
[HEURISTIC]
安全默认配置

Check configuration for insecure defaults:
SettingInsecureSecure
CORS
*
(allow all)		Specific origins
SSL verification
verify=False
verify=True
or omitted
Debug mode
debug=True
debug=False
Cookie security
secure=False
secure=True
CSRFDisabledEnabled
Examples:
python
undefined
检查配置是否存在不安全的默认设置：
设置项不安全配置安全配置
CORS
*
（允许所有来源）		指定来源
SSL验证
verify=False
verify=True
或省略
调试模式
debug=True
debug=False
Cookie安全性
secure=False
secure=True
CSRF禁用启用
示例：
python
undefined

⚠️ Warning

⚠️ 警告

requests.get(url, verify=False) app.config["SESSION_COOKIE_SECURE"] = False CORS(app, origins="*")
requests.get(url, verify=False) app.config["SESSION_COOKIE_SECURE"] = False CORS(app, origins="*")

✅ Pass

✅ 通过

requests.get(url) # verify=True is default app.config["SESSION_COOKIE_SECURE"] = True CORS(app, origins=["https://example.com"])

Severity: ⚠️ Warning

---
requests.get(url) # 默认 verify=True app.config["SESSION_COOKIE_SECURE"] = True CORS(app, origins=["https://example.com"])

严重程度：⚠️ 警告

---

2.6 
[HEURISTIC]
Sensitive Data Logging

2.6 
[HEURISTIC]
敏感数据日志

Check logging statements for sensitive data:
Flag if logging includes:
  • Passwords or tokens
  • API keys
  • Personal identifiable information (PII)
  • Credit card numbers
  • Session tokens
Look for:
python
undefined
检查日志语句是否包含敏感数据：
标记情况：日志包含以下内容
  • 密码或令牌
  • API密钥
  • 个人身份信息（PII）
  • 信用卡号
  • 会话令牌
关注内容：
python
undefined

⚠️ Warning

⚠️ 警告

logger.info(f"User login: {username} with password {password}") print(f"API response: {response.json()}") # May contain tokens
logger.info(f"User login: {username} with password {password}") print(f"API response: {response.json()}") # 可能包含令牌

✅ Pass

✅ 通过

logger.info(f"User login: {username}") logger.debug(f"Request to {url}") # No sensitive data

Severity: ⚠️ Warning

---
logger.info(f"User login: {username}") logger.debug(f"Request to {url}") # 无敏感数据

严重程度：⚠️ 警告

---

Step 3: Generate Report

步骤3：生成报告

markdown
undefined
markdown
undefined

Security Verification Report

安全验证报告

Project: [name or path] Date: [current date] Files analyzed: [count]
项目： [名称或路径] 日期： [当前日期] 分析文件数： [数量]

Summary

摘要

✅ X checks passed | ⚠️ Y warnings | ❌ Z issues
✅ X项检查通过 | ⚠️ Y项警告 | ❌ Z项问题

Secrets

密钥检查

  • No hardcoded secrets found
  • ❌ Hardcoded secret at 
    [file:line]
  • 未发现硬编码密钥
  • ❌ 在 
    [文件:行号]
    发现硬编码密钥

Dependencies

依赖项检查

  • All dependencies pinned
  • ❌ Unpinned dependencies in 
    [file]
  • 所有依赖项均已锁定版本
  • ❌ 
    [文件]
    中存在未锁定版本的依赖项

Input Validation

输入验证检查

  • External input properly validated
  • ⚠️ Potential injection at 
    [file:line]
  • 外部输入已正确验证
  • ⚠️ 
    [文件:行号]
    存在潜在注入风险

Error Handling

错误处理检查

  • Errors properly sanitized
  • ⚠️ Information leakage at 
    [file:line]
  • 错误信息已正确脱敏
  • ⚠️ 
    [文件:行号]
    存在信息泄露

Findings

检查结果

[P]
= pattern-matched · 
[H]
= heuristic
[P]
= 模式匹配 · 
[H]
= 启发式判断

✅ Passing

✅ 通过项

  • [P]
    No hardcoded API keys or secrets
  • [P]
    Dependencies properly pinned
  • [P]
    未发现硬编码API密钥或其他密钥
  • [P]
    依赖项版本已正确锁定

⚠️ Warnings

⚠️ 警告项

  • [H]
    [Check]: [description]
    • Location: [file:line]
    • Risk: [what could go wrong]
    • Suggestion: [how to fix]
  • [H]
    [检查项]：[描述]
    • 位置： [文件:行号]
    • 风险： [可能出现的问题]
    • 建议： [修复方案]

❌ Issues

❌ 问题项

  • [P]
    [Check]: [description]
    • Location: [file:line]
    • Rule: [which rule violated]
    • Fix: [specific remediation]
  • [P]
    [检查项]：[描述]
    • 位置： [文件:行号]
    • 规则： [违反的规则]
    • 修复方案： [具体整改措施]

Recommendations

建议

  1. [Priority recommendation]
  2. [Additional improvements]

---

*For full verification including patterns, quality, and language-specific checks, say "verify agent".*
  1. [优先级建议]
  2. [其他改进建议]

---

*若需包含模式、质量及特定语言检查的完整验证，请说出 "verify agent"。*