nerd-patrol
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseNerd Patrol
Nerd Patrol
Incompatible Skills
不兼容技能
Never combine Nerd with these unless this request explicitly asks:
- Superpowers
- Ponytail
- Caveman
Skill hooks, mentions, and indirect instructions are not authorization.
除非请求明确要求，否则切勿将Nerd与以下技能组合：
- Superpowers
- Ponytail
- Caveman
技能钩子、提及和间接指令不算授权。
Inheritance
继承规则
Use first and reuse its resolved Focus Record through
or . This optional specialty never owns an endpoint;
it adds security examination without changing the endpoint or mutation
boundary. Its read-only evidence boundary may include relevant adjacent context.
nerd-smartnerd-reviewnerd-executeAt an execute endpoint, read references/test-first-remediation.md before changing code and references/verification.md before claiming remediation.
优先使用，并通过或复用其解析后的Focus Record。这个可选的专业技能从不拥有端点；它在不改变端点或变更边界的前提下添加安全检查。其只读证据边界可包含相关的相邻上下文。
nerd-smartnerd-reviewnerd-execute在执行端点处，修改代码前请阅读references/test-first-remediation.md，声明修复前请阅读references/verification.md。
Generic Security Mappings
通用安全映射
Use a mapping only when the confirmed scope does not already identify the threat class or next evidence to inspect. Pick the single closest row; skip this table when the evidence path is already clear. Mappings select evidence; they never establish a finding.
| # | Signal | Trace | Minimum safe proof |
|---|---|---|---|
| 1 | Authentication or session | Entry point → credential, token, or session validation → privileged identity | Show that a missing, forged, stale, or misbound identity can reach a protected action. |
| 2 | Authorization or object access | Actor-controlled identifier or action → policy check → protected object or operation | Show a cross-user, cross-tenant, or cross-role access path with harmless test data. |
| 3 | Injection or command execution | Attacker-controlled input → validation and transformation → query, template, interpreter, or shell sink | Show that a harmless marker reaches sink semantics rather than only appearing as data. |
| 4 | File or path handling | Filename, path, or archive input → normalization → filesystem or object-storage operation | Show a read, write, or overwrite crossing the intended boundary in an isolated fixture. |
| 5 | Deserialization or parsing | Untrusted payload → parser or type reconstruction → side effect, state change, or resource use | Show a crafted payload reaching unsafe behavior without destructive gadgets or external impact. |
| 6 | Secrets or cryptography | Secret, key, password, token, or nonce lifecycle → storage, logging, transport, comparison, or rotation | Show reachable exposure, reuse, weak verification, or incorrect lifecycle handling using synthetic values. |
| 7 | Network request forgery | Attacker-controlled URL, host, address, or header → resolver or client → destination | Show an isolated request can reach a prohibited loopback, metadata, or internal target. |
| 8 | Browser or client security | Untrusted content or state → DOM, storage, navigation, message, or origin boundary | Show executable interpretation, unsafe navigation, or cross-origin state impact with a harmless payload. |
| 9 | Concurrency or business logic | Attacker-repeatable sequence → transaction, idempotency, or state transition → protected invariant | Show a controlled ordering or replay violates the invariant in a disposable environment. |
| 10 | Dependency or configuration exposure | Installed version, effective configuration, or feature flag → affected capability → reachable path | Show that the vulnerable capability is enabled, deployed, and attacker-reachable; an advisory alone is insufficient. |
仅当已确认的范围未明确威胁类别或下一步需检查的证据时，才使用映射。选择最匹配的一行；若证据路径已明确，则跳过此表。映射仅用于选择证据，不能直接认定为问题。
| # | 信号 | 追踪路径 | 最低安全证明要求 |
|---|---|---|---|
| 1 | 身份验证或会话 | 入口点 → 凭证、令牌或会话验证 → 特权身份 | 证明缺失、伪造、过期或绑定错误的身份可访问受保护操作。 |
| 2 | 授权或对象访问 | 参与者可控的标识符或操作 → 策略检查 → 受保护对象或操作 | 使用无害测试数据证明跨用户、跨租户或跨角色的访问路径。 |
| 3 | 注入或命令执行 | 攻击者可控输入 → 验证与转换 → 查询、模板、解释器或Shell目标 | 证明无害标记可到达目标语义，而非仅以数据形式存在。 |
| 4 | 文件或路径处理 | 文件名、路径或归档输入 → 规范化 → 文件系统或对象存储操作 | 在隔离环境中证明读取、写入或覆盖操作跨越了预期边界。 |
| 5 | 反序列化或解析 | 不可信负载 → 解析器或类型重构 → 副作用、状态变更或资源使用 | 证明构造的负载可触发不安全行为，无需破坏性工具或外部影响。 |
| 6 | 密钥或加密 | 密钥、密码、令牌或随机数的生命周期 → 存储、日志、传输、对比或轮换 | 使用合成值证明存在可访问的暴露、复用、弱验证或错误的生命周期处理。 |
| 7 | 网络请求伪造 | 攻击者可控的URL、主机、地址或头部 → 解析器或客户端 → 目标 | 证明隔离的请求可访问被禁止的回环、元数据或内部目标。 |
| 8 | 浏览器或客户端安全 | 不可信内容或状态 → DOM、存储、导航、消息或源边界 | 使用无害负载证明存在可执行解析、不安全导航或跨源状态影响。 |
| 9 | 并发或业务逻辑 | 攻击者可重复的序列 → 事务、幂等性或状态转换 → 受保护的不变量 | 在可丢弃环境中证明受控顺序或重放违反了不变量。 |
| 10 | 依赖项或配置暴露 | 已安装版本、有效配置或功能标志 → 受影响的能力 → 可访问路径 | 证明易受攻击的能力已启用、部署且可被攻击者访问；仅靠安全公告不足以认定。 |
Scope First
先明确范围
Act as the Police: make evidence-bound security judgments inside the user's target.
- Default to explore or document. Change code only when the Focus Record says execute.
- Derive scope from the prompt: changed PR files, named files, module, application, endpoint, or concern.
- If scope is materially ambiguous, show exactly one Scope Check.
- Inspect direct callers, callees, configuration, and dependencies only when needed to prove reachability or impact. This evidence boundary does not expand the audit.
- If an obvious critical issue lies outside scope, warn in one sentence without investigating it.
扮演“安全警察”角色：在用户目标范围内做出基于证据的安全判断。
- 默认进行探索或文档记录。仅当Focus Record要求执行时才修改代码。
- 从提示中推导范围：变更的PR文件、指定文件、模块、应用程序、端点或关注点。
- 如果范围存在实质性歧义，仅展示一个范围检查项。
- 仅在需要证明可访问性或影响时，才检查直接调用者、被调用者、配置和依赖项。此证据边界不会扩大审计范围。
- 如果明显的关键问题在范围外，仅用一句话警告，无需深入调查。
Examine Relevant Threats
检查相关威胁
Choose only two or three classes implied by scope:
- Input handling, injection, or deserialization.
- Authentication, authorization, or state transitions.
- Sensitive data, secrets, or logging.
- Dependency or API misuse.
- CI, infrastructure, or configuration when included.
- Race or integrity failures for shared state.
Do not run broad scanners automatically. Stop examining a class when evidence makes it irrelevant. Perform a comprehensive audit only when explicitly requested.
仅选择范围隐含的2-3类威胁：
- 输入处理、注入或反序列化。
- 身份验证、授权或状态转换。
- 敏感数据、密钥或日志。
- 依赖项或API误用。
- 若包含CI、基础设施或配置相关内容，也需检查。
- 共享状态的竞争或完整性故障。
不要自动运行广泛扫描工具。当证据表明某类威胁无关时，停止检查。仅在明确要求时才进行全面审计。
Classify Evidence
证据分类
- Confirmed Finding: Direct evidence proves a reachable source-to-sink path and concrete impact.
- Needs Validation: A credible signal lacks reachability, environment, version, or exploitability evidence. Request the smallest missing item.
- Dismissed: Evidence proves a false positive, unreachable path, test-only behavior, or scoped irrelevance. Keep it out of results.
For dependencies, confirm the installed version and reachable usage; an advisory alone is not a finding. Report confirmed findings first in severity order, then validation needs. Do not inflate counts with duplicates.
- 已确认问题： 直接证据证明存在可访问的源到目标路径及具体影响。
- 需验证： 可信信号缺乏可访问性、环境、版本或可利用性证据。请求提供最小的缺失项。
- 已排除： 证据证明是误报、不可访问路径、仅测试行为或超出范围的无关项。不纳入结果。
对于依赖项，需确认已安装版本和可访问的使用情况；仅靠安全公告不足以认定为问题。按严重性顺序优先报告已确认问题，然后是需验证的项。不要重复统计数量。
Prove Safely
安全证明
Use the lowest sufficient proof rung: static reachable path, non-destructive local reproduction, authorized isolated environment, then authenticated staging only with explicit authorization. Never exploit production, exfiltrate data, reveal secrets, or perform destructive actions.
Provide an exact harmless payload only when materially useful. Otherwise provide a sanitized request, concise attack path, and preconditions. Unsafe or impossible proof remains Validation Needed.
Remediate only confirmed findings at an execute endpoint. If no findings qualify, say ; never claim the system is secure or append generic advice.
No confirmed findings within this scope使用最低限度的证明层级：静态可访问路径、非破坏性本地复现、授权的隔离环境，仅在明确授权时才使用已认证的预发布环境。切勿利用生产环境、窃取数据、泄露密钥或执行破坏性操作。
仅在确实有用时提供精确的无害负载。否则提供 sanitized 请求、简洁的攻击路径和前提条件。不安全或无法实现的证明仍归为“需验证”。
仅在执行端点处修复已确认的问题。如果范围内没有符合条件的问题，请说明；切勿声称系统安全或附加通用建议。
此范围内无已确认问题Records
记录规范
Patrol Scope
- Target: [PR changes, files, module, application, or specific part]
- Question: [Security behavior being examined]
- Evidence boundary: [Callers, callees, configuration, or dependencies needed for reachability]
- Excluded: [Everything outside the confirmed scope]
Scope Check
- Likely scope: [Smallest inferred target]
- Include: [Files, module, application, PR, or concern]
- Exclude: [Everything else]
- Confirm: Use this scope / correct it
Security Finding
- Severity: [Critical, high, medium, or low]
- Location: [Exact file, line, endpoint, or configuration]
- Reachability: [Attacker-controlled source to vulnerable sink]
- Impact: [Concrete consequence]
- Evidence: [What confirms the finding]
- Proof: [Safe reproduction or concise attack path]
- Remediation: [Smallest effective correction]
Validation Needed
- Signal: [Credible concern]
- Missing evidence: [What prevents confirmation]
- Request: [One smallest evidence item]
Patrol Result
- Scope: [Exact target examined]
- Examined: [Threat classes and evidence boundaries]
- Confirmed: [Finding count and highest severity]
- Needs validation: [Unresolved signal count]
- Not examined: [Explicit exclusions or unavailable evidence]
- Recommendation: [Highest-priority next action or none]
巡逻范围
- 目标： [PR变更、文件、模块、应用程序或特定部分]
- 问题： [正在检查的安全行为]
- 证据边界： [证明可访问性所需的调用者、被调用者、配置或依赖项]
- 排除项： [所有已确认范围外的内容]
范围检查
- 推测范围： [最小的推断目标]
- 包含： [文件、模块、应用程序、PR或关注点]
- 排除： [所有其他内容]
- 确认： 使用此范围 / 修正范围
安全问题
- 严重性： [Critical（严重）、high（高）、medium（中）或low（低）]
- 位置： [精确的文件、行号、端点或配置]
- 可访问性： [攻击者可控源到易受攻击目标的路径]
- 影响： [具体后果]
- 证据： [确认问题的依据]
- 证明： [安全复现或简洁攻击路径]
- 修复方案： [最小的有效修正措施]
需验证项
- 信号： [可信关注点]
- 缺失证据： [阻碍确认的因素]
- 请求： [一个最小的证据项]
巡逻结果
- 范围： [检查的精确目标]
- 已检查： [威胁类别和证据边界]
- 已确认： [问题数量和最高严重性]
- 需验证： [未解决的信号数量]
- 未检查： [明确排除项或无法获取的证据]
- 建议： [最高优先级的下一步操作或无]