{"slug":"pdlc-security","title":"pdlc-security","summary":"安全审计","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-09-23T18:54:25.826137Z","repo":{"url":"https://github.com/kanfu-panda/pdlc-skills","stars":17,"forks":2,"license":"MIT","updatedAt":"2026-09-25T12:29:01Z"},"bodyHtml":"
\n

name: pdlc-security\ndescription: 安全审计\nargument-hint: <模块 | 服务名>\nallowed-tools: Read, Write, Edit, Glob, Grep, Bash\nlayer: 3\nstage: quality\nproduces:

\n\n
\n

安全审计

\n\n

⛔ IRON LAW · 不可违反的硬门禁

\n

以下规则为不可协商的执行约束：

\n
    \n
  1. 文件必须落盘：所有带编号（功能ID / 缺陷ID）的文档，必须作为实际文件写入磁盘，不可仅在对话中输出。
    2. \n
  2. 阶段必须落章：每个阶段完成后必须在状态机 docs/.pdlc-state/<feature-id>.json 追加 history，不可跳过。
    3. \n
  3. 测试必须存在：进入 /pdlc-implement 前，对应测试必须存在且处于红灯状态。违反则中止。
    4. \n
  4. 自检必须执行：段二自检为强制步骤，不得以\"已经很好了\"为由跳过。
    5. \n
  5. 防循环：段三修复为单次，不递归。无法自动修复的问题记录到报告，继续往下走。
    6. \n
  6. 状态必推进：成功执行某 phase 后 current_stage 必须变更。收尾时若发现 current_stage 未推进，视为失败并报错，不得静默返回（防止外层循环拿滞后的状态空转烧额度）。唯一例外：命中人工点主动 block 时，current_stage 保持不变但必须写 last_phase_result.ok=false + blocked_reason。
    7. \n
\n

违反任一条 = 立即中止当前命令，输出违规详情，等待人工介入。

\n\n

对指定服务或应用进行安全审计，检查常见安全漏洞。

\n

审计范围

\n
    \n

  1. OWASP Top 10 检查

    \n\n
    2. \n

  2. 认证与授权

    \n\n
    3. \n

  3. 数据安全

    \n\n
    4. \n

  4. 依赖安全

    \n\n
    5. \n
\n

输出格式

\n
\n

⚠️ 必须创建文件，不可仅在对话中输出。

\n
\n

【必须创建文件】 在 docs/07_reviews/code/ 下创建安全审计报告：

\n\n

要求

\n\n

\uD83C\uDF10 Output language for generated artifacts

\n

All generated artifacts (PRDs, design docs, code comments, review reports,\ntest plans, deployment manuals, changelog entries, etc.) follow this policy:

\n
    \n

  1. Default — match the conversation language exactly:

    \n\n
    2. \n

  2. Explicit override always wins: when the user specifies a language for\nan artifact (e.g. \"write the PRD in English\", \"用英文写 API 设计文档\",\n\"output the deploy doc in Japanese\"), use that language for that artifact,\nregardless of conversation language.

    \n
    3. \n

  3. Mixed-language requirements: if the user wants some artifacts in one\nlanguage and others in a different language (common: Chinese PRD + English\nAPI docs for partners), honour each per-artifact instruction.

    \n
    4. \n

  4. Uncertain: if you cannot reliably detect the conversation language,\nask once before producing the first artifact.

    \n
    5. \n
\n

This policy applies to content (prose, comments, headings). It does\nnot override technical conventions like English variable names, English\ngit commit subjects, or English error codes when the project's conventions\nrequire them.

\n\n\n

审计目标: $ARGUMENTS

\n\n

段四：交接（Handoff）

\n

命令完成后必须输出以下格式的最终消息：

\n
✅ <阶段名> 完成：<主要产出物路径>\n\uD83D\uDCCA 自检：<通过数>/<总数> 通过（若有未通过，附要点）\n\uD83D\uDCE6 状态快照：docs/.pdlc-state/<feature-id>.json\n\uD83D\uDC49 下一步：/pdlc-<next_step>\n   （如果有分叉）或 /pdlc-<alt>（条件：<选择依据>）\n
\n

规则：

\n\n\n

本命令的 handoff 输出：

\n
✅ 安全审计报告 完成\n\uD83D\uDCE6 产出：docs/04_testing/security/<feature-id>-audit.md\n\uD83D\uDC49 下一步：（本次流程结束，无后续）\n
\n","files":[{"path":"SKILL.md","sizeBytes":6027,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-23T18:54:58.625781Z","sha256":"9B589AE88875A35F1CD007300BEB380410A0C7A839F7AE96919A7CBA0DF79F18","sizeBytes":3506},"review":null,"source":{"repositoryUrl":"https://github.com/kanfu-panda/pdlc-skills","path":"skills/pdlc-security","license":"MIT","commit":"181ecf1fddc46f1e5f3ab04f64f93ae42d35fa34","subtreeSha":"1E16EB98F804AF5D82BA3A4EE8BF62B3607D4F83EE88ADC3429F18700F3C989D","lastSyncedAt":"2026-10-01T15:23:29.701635Z"},"reviewedAt":"2026-09-23T18:56:30.176575Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/kanfu-panda/pdlc-skills/tree/main/skills/pdlc-security"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kanfu-panda-pdlc-skills@llmmart"},{"target":"git","command":"git clone https://github.com/kanfu-panda/pdlc-skills.git"}]}