Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Verify Security · fengshao1227 | DecimalAI

securityby fengshao1227

Verify Security

fengshao1227/verify-security

Source fengshao1227/ccg-workflow ↗License MIT

安全校验关卡。自动扫描代码安全漏洞，检测危险模式，确保安全决策有文档记录。当用户提到安全扫描、漏洞检测、安全审计、代码安全、OWASP、注入检测、敏感信息泄露时使用。在新建模块、安全相关变更、攻防任务、重构完成时自动触发。

SkillScore91Maintained

Automatic

Security & AppSec pack

Last verified 8/9/2026

What it changes

Passed 21 of 23 test cases with the skill, and 17 of 23 without it.

Without skill74%

With skill91%

Checks it passed that the model alone missed

Verifies security documentation in DESIGN.md.
Classifies MD5 crypto usage as Medium severity.
Concludes that the audit status is deliverable.

and 4 more in the full report

4 fixed17 passed either way2 still failing0 broke

Pass-rate lift: +17 pp
Tokens: +28%
Agent turns: 0%
Response time: +1%

Model gemini-3.6-flashMeasured 8/9/2026v121 of 23 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/fengshao1227-verify-security/SKILL.md https://app.decimal.ai/s/fengshao1227-verify-security/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add fengshao1227-verify-security, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/fengshao1227-verify-security/ and pins it in .decimal/skills.lock

decimalai skills add fengshao1227-verify-security

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/fengshao1227-verify-security/SKILL.md https://app.decimal.ai/s/fengshao1227-verify-security/SKILL.md

Raw file: /s/fengshao1227-verify-security/SKILL.md ↗ · machine-readable summary at /s/fengshao1227-verify-security.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 4

Prompt

I just finished refactoring our authentication and data processing module in `./src/auth`. Please run a full security verification scan on this folder, evaluate any dangerous code patterns or unhandled security threats, check if security decisions are properly documented, and give me a complete security inspection report with issue severities and a delivery recommendation.

What was checked, without and with the skill
Checked	Without skill	With skill
Executes the script node scripts/security_scanner.js against path ./src/auth.	Missed	Passed
Verifies security documentation in DESIGN.md.	Missed	Passed
Requires zero Critical findings for delivery approval.	Missed	Passed

case-01 · gemini-3.6-flash · 8/9/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md132 lines2 filesincludes scripts

⚖ 校验关卡 · 安全校验

核心原则

安全即道基，破则劫败
安全决策必须可追溯
Critical/High 问题必须修复后才能交付

自动扫描

运行安全扫描脚本（跨平台）：

# 在 skill 目录下运行
node scripts/security_scanner.js <扫描路径>
node scripts/security_scanner.js <扫描路径> -v           # 详细模式
node scripts/security_scanner.js <扫描路径> --json       # JSON 输出
node scripts/security_scanner.js <扫描路径> --exclude vendor  # 排除目录

检测范围

自动检测的漏洞类型

类别	检测项	严重度
注入	SQL 注入、命令注入、代码注入	🔴 Critical
敏感信息	硬编码密钥、AWS Key、私钥	🔴 Critical
XSS	innerHTML、dangerouslySetInnerHTML	🟠 High
反序列化	pickle.loads、yaml.load	🟠 High
路径遍历	未验证的文件路径操作	🟠 High
SSRF	未验证的 URL 请求	🟠 High
XXE	不安全的 XML 解析	🟠 High
弱加密	MD5、SHA1 用于安全场景	🟡 Medium
不安全随机	random 模块用于安全场景	🟡 Medium
调试代码	console.log、print、debugger	🔵 Low

Track record

Benchmark

21 / 23

test cases passed, vs 17 / 23 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

fengshao1227 / ccg-workflow

templates/skills/tools/verify-security/SKILL.md

View on GitHub ↗

License MITImported 9/1/2026Version v1Bundled 1 file · scripts

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

More skills from the same source and nearby in the registry, with their headline benchmark lift.