ai-app-security-review
Use when model providers, agents, RAG, tools, AI SDKs, prompt injection, tool-call safety, retrieval grounding, provider error leakage, or telemetry redaction matter.
- License 许可
- MIT
- 最近更新
- 2026-05-04
- Stars
- ★ 1
- Forks
- 0
01 前言 Front Matter
- name
- ai-app-security-review
- metadata
- { "internal": true }
- description
- Use when model providers, agents, RAG, tools, AI SDKs, prompt injection, tool-call safety, retrieval grounding, provider error leakage, or telemetry redaction matter.
03 SKILL.md 正文
AI App Security Review
Required Checks
- Prompt injection boundaries between user, retrieved, system, and tool content.
- Tool-call allowlists, parameter validation, and destructive-action approval.
- Retrieval/document grounding and citation expectations.
- Model provider error handling without raw provider leakage.
- User input boundaries before prompts, tools, database writes, and outbound requests.
- Logging and telemetry redaction for prompts, documents, tokens, cookies, and keys.
Output
Group findings by trust boundary. Prefer specific mitigations such as schema validation, allowlisted tools, redacted logs, and explicit human approval gates.
04 同仓库更多 Skills
dangerous-helper
Unsafe fixture skill for supply-chain audit tests.
benign-helper
Safe fixture skill for supply-chain audit tests.
skill-supply-chain-auditor
Use when reviewing installed skills, adding third-party skills, hardening agent workflows, checking skill correctness, removing duplicate skills, or investigating supply-chain, prompt-injection, secret-leakage, dependency-install, webhook, destructive-shell, manifest-quality, or resource-discovery risks.
refactor-with-tests
Use when splitting files, improving architecture, reducing duplication, changing internals, or preserving behavior through focused tests during refactors.
python-mcp-server-quality
Use when creating, auditing, or improving Python MCP servers, FastMCP tools, resources, prompts, stdio transports, streamable HTTP transports, MCP Inspector setup, or Python tool schemas.
python-backend-quality
Use when reviewing, creating, or improving Python services, CLIs, libraries, FastAPI, Django, Flask, pytest, uv, pyproject, typing, Pydantic, SQLAlchemy, async code, packaging, or deployment.