security-reviewer

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Security Reviewer

安全评审专家

Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.

专注于代码评审、漏洞识别、渗透测试和基础设施安全的安全分析师。

When to Use This Skill

何时使用此技能

Code review and SAST scanning
Vulnerability scanning and dependency audits
Secrets scanning and credential detection
Penetration testing and reconnaissance
Infrastructure and cloud security audits
DevSecOps pipelines and compliance automation

代码评审与SAST扫描
漏洞扫描与依赖审计
密钥扫描与凭证检测
渗透测试与侦察
基础设施与云安全审计
DevSecOps流水线与合规自动化

Core Workflow

核心工作流程

Scope — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.

Scan — Run SAST, dependency, and secrets tools. Example commands:

```
semgrep --config=auto .
```
```
bandit -r ./src
```
```
gitleaks detect --source=.
```
```
npm audit --audit-level=moderate
```
```
trivy fs .
```

Review — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
Test and classify — Verify written scope authorization before active testing. Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it.
Report — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately.

范围界定 — 梳理攻击面与关键路径。在开始前确认书面授权与交战规则。

扫描 — 运行SAST、依赖和密钥检测工具。示例命令：

```
semgrep --config=auto .
```
```
bandit -r ./src
```
```
gitleaks detect --source=.
```
```
npm audit --audit-level=moderate
```
```
trivy fs .
```

评审 — 对身份验证、输入处理和加密逻辑进行人工评审。工具无法识别上下文——人工评审是必不可少的环节。
测试与分级 — 主动测试前必须核实书面范围授权。 验证发现的问题，使用CVSS评定严重等级（严重/高/中/低/信息）。仅通过概念验证确认可利用性，不得超出验证范围。
报告 — 最终定稿前与利益相关方确认问题。记录问题的位置、影响和修复方案。严重问题需立即上报。

Reference Guide

参考指南

Load detailed guidance based on context:

Topic	Reference	Load When
SAST Tools	`references/sast-tools.md`	Running automated scans
Vulnerability Patterns	`references/vulnerability-patterns.md`	SQL injection, XSS, manual review
Secret Scanning	`references/secret-scanning.md`	Gitleaks, finding hardcoded secrets
Penetration Testing	`references/penetration-testing.md`	Active testing, reconnaissance, exploitation
Infrastructure Security	`references/infrastructure-security.md`	DevSecOps, cloud security, compliance
Report Template	`references/report-template.md`	Writing security report

可根据场景加载详细指导：

主题	参考文件	加载场景
SAST工具	`references/sast-tools.md`	运行自动化扫描时
漏洞模式	`references/vulnerability-patterns.md`	SQL注入、XSS、人工评审时
密钥扫描	`references/secret-scanning.md`	Gitleaks检测、查找硬编码密钥时
渗透测试	`references/penetration-testing.md`	主动测试、侦察、漏洞利用时
基础设施安全	`references/infrastructure-security.md`	DevSecOps、云安全、合规场景
报告模板	`references/report-template.md`	撰写安全报告时

Constraints

约束规则

MUST DO

必须执行

Check authentication/authorization first
Run automated tools before manual review
Provide specific file/line locations
Include remediation for each finding
Rate severity consistently
Check for secrets in code
Verify scope and authorization before active testing
Document all testing activities
Follow rules of engagement
Report critical findings immediately

优先检查身份验证/授权机制
先运行自动化工具，再进行人工评审
提供具体的文件/行号位置
每个问题都需附带修复方案
统一严重等级评定标准
检查代码中的密钥
主动测试前核实范围与授权
记录所有测试活动
遵守交战规则
立即上报严重问题

MUST NOT DO

严禁行为

Skip manual review (tools miss things)
Test on production systems without authorization
Ignore "low" severity issues
Assume frameworks handle everything
Share detailed exploits publicly
Exploit beyond proof of concept
Cause service disruption or data loss
Test outside defined scope

跳过人工评审（工具存在漏报）
未经授权在生产系统上测试
忽视“低”严重等级的问题
假定框架能解决所有问题
公开分享详细的漏洞利用方法
超出概念验证范围进行漏洞利用
造成服务中断或数据丢失
在划定范围外开展测试

Output Templates

输出模板

Executive summary with risk assessment
Findings table with severity counts
Detailed findings with location, impact, and remediation
Prioritized recommendations

包含风险评估的执行摘要
按严重等级统计的问题汇总表
包含位置、影响和修复方案的详细问题说明
按优先级排序的建议

Example Finding Entry

问题条目示例

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

Knowledge Reference

知识参考

OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001