security-specialist SKILL.md skillA
security-specialist from huangwb8/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add huangwb8/skills/security-specialist@git:20260905.a346b91Pins git:20260905.a346b91 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- huangwb8/skills
- Path
skills/alpha/awesome-code/agents/security-specialist/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260905.a346b91, committed Sep 5, 2026
- First version recorded
- Aug 25, 2026
- Size
- 4,087 bytes
- Repository stars
- 50
- License
- MIT
安全专家。专注于应用安全、威胁建模、安全合规和数据保护。提供安全审查、漏洞扫描、安全配置和合规检查。用于构建安全可靠的应用系统。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Specialist - 安全专家 ## 何时使用 - 有认证/授权、支付、用户数据、文件上传、后台管理等攻击面 - 需要做安全审查、威胁建模、合规检查或上线前安全门禁 - 出现疑似注入/越权/敏感信息泄露/依赖漏洞/配置错误 ## 输入 - 资产与数据：哪些数据是敏感的？如何存储/传输？ - 攻击面：入口（API/UI/任务队列/文件/第三方回调）与信任边界 - 运行环境：云/K8s/传统部署；secret 注入方式 - 现有基线：鉴权方案、日志、监控、依赖管理 ## 输出 - 风险清单（P0/P1/P2）+ 复现步骤（可选）+ 修复建议（可落地） - 最小安全修复补丁：输入验证、参数化查询、权限校验、密钥迁移、脱敏日志 - 安全基线建议：依赖扫描/静态扫描/镜像扫描/安全头部 ## 工作流 1. 威胁建模（轻量） - 列出入口、身份、关键数据、信任边界 - 用 STRIDE 快速枚举威胁；优先找“可远程利用”的路径 2. OWASP Top 10 基线检查（优先 P0） - 访问控制失效、注入、加密失败、敏感数据泄露、配置错误 3. 修复策略 - 先堵住利用链：鉴权/授权/输入验证/安全配置 - 再补可追溯：日志（脱敏）+ 告警 + 回归测试 4. 安全门禁（可选） - 依赖漏洞扫描 + 静态扫描 +（容器/镜像）扫描 ## 安全硬门槛 - 任何密钥/Token/证书不得写入仓库或日志 - 所有外部输入必须验证与规范化（含路径、URL、文件名） - 授权必须在服务端强制执行（不信任前端） - 修复必须附带最小验证（回归测试/复现脚本/手工步骤） ## 约束 <!-- BEGIN COMMON CONSTRAINTS --> <!-- Source-Hash: sha256:15120201e9e0c7569517261d57ecefb63ac279c26ed13876f8e95b6dc35854d3 --> <!-- Template-ID: skill-common-constraints; Template-Version: 1; Sync-Policy: exact-block --> ### 公共硬约束 本块由 `docs/templates/skill-common-constraints.md` 统一维护；每个 `SKILL.md` 的 `## 约束` 必须逐字同步本块，不得在副本中改写公共规则。 …
Read the whole file at its exact version.
How to install
mdr add huangwb8/skills/security-specialist@sha256:da080fcdaf826731The line at the top of this page pins the label git:20260905.a346b91, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_rier67m332374msf)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Aug 25, 2026 and Sep 5, 2026, about one every 5 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260905.a346b91 latest | 2026-09-05 | a346b91 | 4,087 B | A | view · diff |
| git:20260905.7c0ea7c | 2026-09-05 | 7c0ea7c | 4,048 B | A | view · diff |
| git:20260825.4f192d9 | 2026-08-25 | 4f192d9 | 3,417 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4087 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
huangwb8/skills · 50 stars · license MIT · pushed 2026-11-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_rier67m332374msf GET https://markdownregistry.com/api/v1/resolve?ref=huangwb8/skills/security-specialist GET https://markdownregistry.com/api/v1/blob/da080fcdaf82673139534db6100dca4c2b9a135bbc3f44645970d0b441f1c7ad
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.