security▌

'Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Use when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do NOT use for general maintainer lists, non-security ownership questions, or threat modeling (use security-threat-model).'

Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations.

Conducts multi-axis code review to assess code quality across correctness, readability, architecture, security, and performance before merging changes.

Safe read-only PostgreSQL audit workflow using https://postgresaudit.com/ for least-privilege setup, report interpretation, and remediation planning.

Security-audit skill that combines application security, infrastructure review, CI/CD checks, supply-chain scanning, LLM security, OWASP framing, and STRIDE analysis.

You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection points, unsafe DOM manipulation, and improper sanitization.

Category: test \n CloudFW Minimal Viable Test \n Prerequisites \n \n AK/SK and region are configured. \n GoalsSkill: skills/security/firewall/alicloud-security-cloudfw/ 。 \n \n Test Steps \n \n 先跑元数据 API 列表脚本。 \n 选择一个只读列表/详情 API 执行。 \n 记录请求摘要和响应摘要。 \n \n Expected Results \n \n 可拿到资源列表或明确无权限提示。 \n

Category: test \n SAS Minimal Viable Test \n Prerequisites \n \n AK/SK and region are configured. \n GoalsSkill: skills/security/host/alicloud-security-center-sas/ 。 \n \n Test Steps \n \n 获取 SAS 的 API 列表。 \n 执行一个只读查询 API。 \n 记录成功/失败及错误码。 \n \n Expected Results \n \n 请求链路可达，返回可解析 JSON。 \n

Category: test \n KMS Minimal Viable Test \n Prerequisites \n \n AK/SK and region are configured. \n GoalsSkill: skills/security/key-management/alicloud-security-kms/ 。 \n \n Test Steps \n \n 通过 OpenAPI 元数据确认 KMS 常用读取 API。 \n 执行一个只读查询（如 ListKeys 或产品支持的等价读接口）。 \n 记录 request id、返回数量、错误码（若有）。 \n \n Expected Results \n \n 只读查询成功或返回明确权限错误。 \n