Help us improve
Share bugs, ideas, or general feedback.
From rldyour-security
Защитный Mythos-style security review для diff/PR/чувствительного кода. Используй для: /rldyour-security:ry-sec-review, проверь безопасность, секьюрити ревью, проверь авторизацию и секреты, найди уязвимости, threat-моделирование. EN triggers: security review, audit security, threat model, OWASP audit, hypothesis-driven security, defensive review, vulnerability review, audit auth/authz/secrets/injection.
npx claudepluginhub nddev-it-com/rldyour-claudecode --plugin rldyour-securityHow this skill is triggered — by the user, by Claude, or both
Slash command
/rldyour-security:ry-sec-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Run a high-quality defensive security review of the current implementation. This is not a general code review and not a blocking policy gate by default. It produces evidence-based findings and comments so the agent can decide what to fix immediately and what to report as follow-up.
Searches USPTO patent and trademark records from official APIs including PatentSearch, TSDR, and assignment databases.
Share bugs, ideas, or general feedback.
Run a high-quality defensive security review of the current implementation. This is not a general code review and not a blocking policy gate by default. It produces evidence-based findings and comments so the agent can decide what to fix immediately and what to report as follow-up.
User-facing reports are written in Russian unless the user asks otherwise. Code, paths, symbols, vulnerability categories, and references stay exact.
This skill is slash-only (disable-model-invocation: true). Apply it when /ry-sec-review is invoked or the user explicitly asks for security review of:
/ry-sec-review slash command invocation.Do not use this skill for ordinary implementation unless the user asks for security review or the change is high-risk enough to require a focused audit. For lightweight secure-coding comments during implementation, use owasp-top-10-implementation.
Use a Mythos-inspired review style without copying unsafe behavior:
Before reviewing, determine:
If scope is unclear, make a reasonable assumption and state it. Do not stop unless the review cannot be bounded safely.
get_symbols_overview, targeted find_symbol, find_referencing_symbols, and search_for_pattern.mcp__plugin_rldyour-mcps_semgrep__*) and local project security scripts - but do not rely on scanners as the only evidence.Review against:
A01:2025 Broken Access Control: missing server-side authorization, IDOR/BOLA, tenant boundary bypass, admin route exposure, confused deputy.A02:2025 Security Misconfiguration: debug exposure, permissive CORS, missing headers, unsafe cloud/IaC defaults, exposed credentials/config.A03:2025 Software Supply Chain Failures: vulnerable dependencies, untrusted scripts, unsigned artifacts, unpinned images/actions, typosquatting risk.A04:2025 Cryptographic Failures: weak crypto, bad randomness, plaintext sensitive data, key misuse, token storage and transport issues.A05:2025 Injection: SQL/NoSQL/LDAP/template/command injection, unsafe eval, shell interpolation, unsafe deserialization.A06:2025 Insecure Design: race conditions, business logic abuse, missing abuse controls, replay, quota/rate limit bypass, unsafe workflow assumptions.A07:2025 Authentication Failures: weak reset/login/session/token flow, MFA bypass, session fixation, missing re-auth for sensitive operations.A08:2025 Software or Data Integrity Failures: mass assignment, unsafe update/webhook handling, unverified signed data, trusted client-controlled state.A09:2025 Security Logging & Alerting Failures: missing audit trail, sensitive logs, lack of alertable authz/authn/security events.A10:2025 Mishandling of Exceptional Conditions: fail-open errors, leaked stack traces/secrets, inconsistent rollback, exception path bypass.Also check AI/LLM surfaces when present: prompt injection, tool injection, data exfiltration through model output, untrusted tool arguments, unsafe generated code execution, and cost/resource abuse.
Findings must come first and be ordered by severity.
Use this format:
- Severity: Critical | High | Medium | Low | Info
Category: OWASP/ASVS/security class
Confidence: 0-100
Location: `path:line` or `symbol`
Evidence: concrete code/config behavior proving the issue
Attack path: high-level defensive explanation without weaponized steps
Impact: what can go wrong
Fix: precise remediation
Verification: exact test, command, or manual check
If no findings are found, state that explicitly and list residual risks or untested areas.
Do not provide exploit payloads, malware behavior, stealth/persistence instructions, credential extraction steps, or destructive commands. For explicit destructive requests such as deleting protected paths with rm -rf, follow Claude Code safety and approval rules.
Use harmless proof only when necessary: describe the condition, test expectation, and safe reproduction shape without weaponizing it.
Do not report secrets verbatim. If a secret-like value is found, redact it and identify only the file path, variable name, and exposure class.
For a standalone review, answer in Russian (when the user wrote in Russian) with:
Findings: ordered by severity using the finding format.Rejected hypotheses: important high-risk hypotheses that were checked and rejected, with brief evidence.Residual risks: untested areas, missing runtime context, or scanner gaps.Verification: commands/tools run and what they proved.Recommended fixes: immediate fixes and optional hardening.For implementation-after-review, keep the final concise: fixed findings, checks run, and remaining risk.
path:line or symbol-level evidence