Security Review Pack

Server-side entitlement, secret handling and MCP permission risk review.

Совместимость93

Собрать стек с этим паком

Совместимые модели

GPT-5.5
Claude Opus
Codex

Внутри пака

rules
threat model
review checklist

Включенные workflow

Entitlement audit
Secrets checklist
MCP risk labels
Path safety review

Установить skill pack

Скачай через серверно-проверенный manifest API, запусти installer из корня проекта и перезапусти Codex.

Скачать JSON

Команда установки

node scripts/install-skill-pack.mjs ./security-review.skillpack.json

Codex skills устанавливаются в $CODEX_HOME/skills. Installer не перезаписывает существующие папки skills.

{
  "schemaVersion": 1,
  "kind": "artificial-search.skill-pack",
  "id": "security-review",
  "name": "Security Review Pack",
  "summary": "Server-side entitlement, secret handling and MCP permission risk review.",
  "tier": "Pro",
  "compatibilityScore": 93,
  "notice": "This installs Codex skill files from the pack manifest. MCP servers still require a separate verified mcp.json configuration.",
  "install": {
    "target": "$CODEX_HOME/skills",
    "command": "node scripts/install-skill-pack.mjs ./security-review.skillpack.json",
    "steps": [
      "Download this manifest as security-review.skillpack.json.",
      "Run the installer from the Artificial Search project root.",
      "Restart Codex after installation so the new skills are loaded."
    ]
  },
  "skills": [
    {
      "id": "security-review-rules",
      "name": "Security Review Pack Rules",
      "description": "Rules skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-rules\ndescription: \"Rules skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Rules\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Use the pack scope before choosing a model, MCP server or prompt chain.\n- Keep generated outputs tied to explicit user intent and validated project context.\n- Do not expose secrets, private files or credentials through MCP tools.\n"
        }
      ]
    },
    {
      "id": "security-review-workflow",
      "name": "Security Review Pack Workflow",
      "description": "Workflow skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-workflow\ndescription: \"Workflow skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Workflow\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Entitlement audit\n- Secrets checklist\n- MCP risk labels\n- Path safety review\n"
        }
      ]
    },
    {
      "id": "security-review-validation",
      "name": "Security Review Pack Validation",
      "description": "Validation skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-validation\ndescription: \"Validation skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Validation\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Check the recommended model and agent against the task constraints.\n- Verify every MCP server permission before using the generated config.\n- Run the relevant lint, build, smoke or review gate before delivery.\n"
        }
      ]
    }
  ]
}

Как использовать

Выбери модель и агента под тип задачи: кодинг, документы, автоматизация или приватная локальная работа.

Подключай только MCP серверы, нужные для workflow, и проверяй permissions до доступа к файлам или секретам.

Перед сдачей прогоняй checklist пака, чтобы prompts, rules и проверки оставались последовательными.