Web Security Reviewer

對使用者自己的程式碼做防禦性安全審查，檢測資安漏洞、資料外洩風險、壓力／效能風險與程式品質，並產出「依嚴重度排序的風險報告＋修正後程式碼」。涵蓋 Google Apps Script（Workspace 自動化）、前端 HTML/CSS/JS、後端 API（Node/Python/PHP 等）。特別適用於「使用者用 AI 生成 / vibe coding 寫出來、希望更安全、避免被攻擊或破壞」的網頁程式碼。MANDATORY TRIGGERS：使用者要求「檢測程式碼安全」「幫我看這段 code 有沒有漏洞」「防止資料外洩」「review 我的網頁／後端程式」「這段會不會被攻擊／被駭」「加固 / harden」「壓力測試」「優化程式碼安全性」「個資會不會外洩」「這是 AI 寫的幫我看安不安全」，或貼上一段前端／後端／Apps Script 程式碼並要求審查、找漏洞、修正建議、加固時，都要套用此 skill。即使使用者沒明說「資安」，只要意圖是審查或加固自己的程式碼，就觸發。SCOPE：本 skill 僅用於防禦性檢測——找出並修補使用者自己程式碼裡的漏洞；不協助撰寫可直接攻擊用的 exploit、不協助繞過資安機制。本 skill 同時是 agentic-dev-loop「Verify 雙閘」的安全閘：當該編排器要在部署前驗證安全／個資時會呼叫本 skill；使用者單獨要求安全審

5 starsSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add goingli0324/web-security-reviewer --skill web-security-reviewer

Manual install

git clone --depth 1 https://github.com/goingli0324/web-security-reviewer.git /tmp/web-security-reviewer
mkdir -p ~/.claude/skills
cp -r /tmp/web-security-reviewer/. ~/.claude/skills/web-security-reviewer

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# 網頁程式碼安全檢測（Web Security Reviewer）

對使用者提供的程式碼做有系統的防禦性審查，輸出一份結構化風險報告與可直接套用的修正版程式碼。目標是「找出問題 → 解釋為什麼危險 → 給可調整的修補方向」，而不是只丟一句「有漏洞」。

## 核心原則

1. **嚴重度看脈絡，不確定就先問。** 同一段程式碼，部署成「只有自己能用的內部工具」和「對外公開的網路服務」，嚴重度天差地遠。動手前先確認：這段程式碼的用途、執行環境、是否處理個資、怎麼部署、誰會存取。脈絡不清時，先問一兩個關鍵問題再審查，不要自己腦補成「比較安全」的版本。

2. **誠實標註限制。** 靜態讀程式碼 ≠ 滲透測試或資安稽核，一定有抓不到的東西（商業邏輯漏洞、執行期才暴露的問題）。報告「乾淨」不等於系統安全。每份報告都要有「未能評估的部分」這一段。

3. **套件漏洞不要憑記憶背。** 相依套件的 CVE 依賴當前漏洞資料庫與 lockfile，模型的知識有時間截點。要明確要求使用者跑 `npm audit` / `pip-audit` / `osv-scanner`，不要列出可能過時的 CVE 編號當定論。判斷該專案是否適用、選哪個工具、怎麼讀結果，見 `references/dependency-scanning.md`（純 GAS 線上專案通常不適用，要特別留意）。

4. **能直接修的就直接修，不能替使用者決定的才用列的。** 把每個發現歸成三類並標記：
   - **✅ 已直接修正**：機械式、低風險、不改變預期功能的修正（輸入驗證、輸出跳脫、公式注入防護、參數化查詢、加鎖、log 遮蔽、把硬寫金鑰改成從設定讀取、分頁上限、CORS／標頭設定）→ 直接套進輸出的修正版程式碼，使用者貼上即可用。
   - **⚠️ 需你決定**：牽涉產品取捨或動到使用者體驗的改動（改回傳格式、改執行身分、停用功能）→ 給建議與取捨，保留決定權。
   - **🔧 需你操作**：skill 動不了的環境層面（部署設定、作廢金鑰、寫入真實祕密值、更新套件、跑 audit／壓測、合規確認）→ 列成待辦。
   邊界：skill 只在「輸出的程式碼」裡套用修正，**絕不**代替使用者操作其環境（不改部署、不動分享權限、不寫入真實金鑰、不執行交易）。

5. **要詳盡。** 每個發現不要只說「有漏洞」。要寫到：問題機制（為什麼會發生）、一個具體但不武器化的攻擊情境示例（讓使用者真的看懂風險）、修補程式碼、以及驗證方式（修完怎麼確認有效）。寧可細，不要含糊。

6. **給方向、標取捨。** 「可選」建議要說明採納好處、不採納後果與取捨（例如為了效能快取資料，反而可能放大外洩面）。

7. **防禦導向。** 描述漏洞時，講清楚到「足以理解並修補」即可，不要寫成可直接複製拿去攻擊的武器化 payload。

## 工作流程

### 第 0 步：釐清範圍
確認受檢程式碼、執行環境、是否處理個資、部署方式、預期使用者規模。若關鍵脈絡缺失（尤其「是否對外公開」與「是否碰個資」），先問再審。

### 第 1 步：偵測技術棧 → 載入對應清單
依程式碼語言／框架，讀取需要的 reference（只讀相關的，不要全載）：
- Google Apps Script（`.gs`、`doGet`/`doPost`、`SpreadsheetApp`、`appsscript.json`）→ `references/security-apps-script.md`

Read the full skill on GitHub

Details

Skill name: web-security-reviewer
Repository: goingli0324/web-security-reviewer
License: MIT
Repo updated: 19 July 2026

FAQ

What does the Web Security Reviewer skill do?

How do I install the Web Security Reviewer skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add goingli0324/web-security-reviewer --skill web-security-reviewer. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Web Security Reviewer popular?

It lives in goingli0324/web-security-reviewer, which has 5 GitHub stars and 0 forks.

Related skills

Deep Security Audit

ravindrakele/claude-skills

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app

SecurityIn 1 list

Tenable Sc Reporting Assistant

hamzhk15/tenable-sc-reporting-assistant

Generate importable Tenable Security Center (Tenable SC / SecurityCenter) XML for dashboards, PDF reports, and CSV exports, then optionally upload them to a SC console via API keys. Works two ways — a freeform mode that maps any dashboard/report a user describes to a catalog of known-good components, proposes the layout for approval, and builds it with tested builders; and a curated "Vulnerability Management and Remediation Planning" dashboard/report as a ready-made starting point. Use whenever someone wants to build, customize, or deploy a Tenable SC dashboard or report of any kind — vulnerab

Security

Deep Security Check

give-jd/deep-security-check

Use when the user asks for a defensive security assessment, security audit, vulnerability scan, or "how safe / how reliable is this code/project/repo". Runs Semgrep (SAST), osv-scanner (dependency CVEs) and gitleaks (secrets) against a local project, then produces a report with a reproducible reliability grade (0-100, A-F). Defensive only — finds weaknesses in code you own; it does not exploit, attack, or test remote targets.

SecurityIn 1 list

Ia Security Skill

antoniocostalopes/ia-security-skill

Auditoria de segurança defensiva pré-entrega para projetos Claude Code. Cobre web, mobile (MASVS), cloud/IaC, web3 e ML/AI em 18 linguagens e 34 frameworks. Devolve relatório Markdown com score 0-100, mapa de postura (seguro/menos seguro/inseguro por área), attack chains e achados detalhados; opcionalmente aplica as correções no código com confirmação por achado. Ativa quando o developer pede para auditar, fazer security review, verificar vulnerabilidades, corrigir/blindar código antes do deploy.

Security

Incident Reporting Navigator

Ansvar-Systems/incident-reporting-navigator-skill

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

SecurityIn 1 list

Skill Evaluator

huajielong/skill-evaluator

Evaluate any skill before installing. Run security gate, score trigger precision, execution quality, and cost efficiency. Get a yes/no recommendation. Use when users find a new skill and ask "这个技能值不值得装？" v3.1: 脚本计数精度+信息密度阈值+脚本完整性检查

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.