ship-secure-code
暂无简介
- License 许可
- MIT
- 最近更新
- 2026-06-16
- Stars
- ★ 4
- Forks
- 0
02 资源文件 19
- 其他examples44 B
- 参考文档lang-java.md48 B
- 参考文档lang-python.md50 B
- 参考文档lang-typescript.md54 B
- 参考文档overrides.example.md56 B
- 参考文档reference-categories.md59 B
- 参考文档reference.md48 B
- 参考文档references/action-button.md6.2 KB
- 参考文档references/buttons.md25.5 KB
- 参考文档references/context-menus.md10.6 KB
- 参考文档references/disclosure-controls.md6.4 KB
- 参考文档references/dock-menus.md2.9 KB
- 参考文档references/edit-menus.md7.8 KB
- 参考文档references/menus.md19.6 KB
- 参考文档references/pop-up-buttons.md4.8 KB
- 参考文档references/pull-down-buttons.md6.4 KB
- 参考文档references/the-menu-bar.md31.1 KB
- 参考文档references/toolbars.md26.5 KB
- 其他tests41 B
03 SKILL.md 正文
../../../../skills/ship-secure-code/SKILL.md
04 同仓库更多 Skills
ship-tested-code
Apply testing best practices (test design, TDD, test strategy, mocking, integration testing, CI/CD testing) when writing or reviewing tests for Python, TypeScript/JavaScript, or Java code. Invoke explicitly for test reviews or test strategy assessments. Do not invoke for shell scripts, config files, or one-off scripts.
ship-secure-code
Apply application-security principles (auth, input validation, injection, XSS/output encoding, CSRF/origin, crypto, secrets, supply chain, PII/logging, resource exhaustion, path traversal, deserialization/SSRF) when writing or reviewing security-sensitive Python, TypeScript/JavaScript, or Java code. Invoke explicitly for security reviews or as the delegation target from ship-reviewed-prs SC persona. Do not invoke for pure styling, shell scripts, one-off prototypes, or non-security code review (use ship-clean-code).
ship-reviewed-prs
Perform a thorough, multi-persona pull-request review (senior engineer, senior security engineer, senior infra/SRE, conditional senior data engineer, plus test-coverage signal). Reads existing PR comment threads and suppresses findings that are already resolved, marked won't-fix, or addressed in a later commit. Computes a deterministic APPROVE / REQUEST_CHANGES / COMMENT decision and can submit the review via gh CLI (with confirmation gating in local mode and full automation in CI).
ship-devops
Apply DevOps and CI/CD review principles (CI pipelines, infrastructure-as-code, container images, secrets/config sourcing, observability, release management, schema migrations, health/readiness, SLO/performance, incident hygiene, and flow/batch signals) when writing or reviewing pipeline YAML, IaC, Dockerfiles, k8s manifests, deploy scripts, and the application code that integrates with them. Invoke explicitly for DevOps/CI/CD reviews, or as the delegation target from the ship-reviewed-prs IN (Senior Infra / SRE / DevOps) persona. Do not invoke for pure styling, application-only logic, one-off prototypes, or test-design depth (use ship-clean-code, ship-secure-code, or ship-tested-code respectively).
ship-debugged-code
Apply systematic debugging practices (reproduction, hypothesis-driven investigation, bisection, root-cause analysis, regression-test design) when investigating, isolating, or fixing bugs in Python, TypeScript/JavaScript, or Java code. Invoke explicitly for bug investigations, incident postmortems, or debugging reviews. Do not invoke for greenfield feature work or pure refactoring with no failure signal.
ship-clean-code
Apply clean code principles (naming, functions, classes, error handling, testing, formatting) when writing or reviewing production-quality Python, TypeScript/JavaScript, or Java code. Invoke explicitly for PR reviews or code quality assessments. Do not invoke for shell scripts, SQL queries, config files, quick prototypes, or single-expression snippets.