mirror of
https://github.com/davila7/claude-code-templates.git
synced 2026-09-19 01:30:23 +08:00
Dani
054c0e56e9
Removed the deprecated 'model: sonnet' field from command frontmatter to fix compatibility issues with Claude Code. Commands will now inherit the model from the active conversation instead of using a hardcoded deprecated model identifier. Changes: - Removed 'model: sonnet' from 142 command files across all categories - Commands now use default model inheritance behavior - Preserved 'model: claude-sonnet-4-5-20250929' in gemini-review.md (valid model) - 67 commands without model field remain unchanged This resolves the "model: sonnet not found" error reported in GitHub issues and aligns with Claude Code's recommended practice of letting commands inherit the conversation model. Affected categories: - Database/Supabase commands (8 files) - Documentation commands (8 files) - Deployment commands (11 files) - Setup commands (14 files) - Performance commands (8 files) - Team commands (14 files) - Security commands (6 files) - NextJS/Vercel commands (10 files) - Sync commands (14 files) - And more across other categories 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
81 lines
3.0 KiB
Markdown
81 lines
3.0 KiB
Markdown
---
|
|
allowed-tools: Read, Bash, Grep, Glob
|
|
argument-hint: [focus-area] | --full
|
|
description: Perform comprehensive security assessment and vulnerability analysis
|
|
---
|
|
|
|
# Security Audit
|
|
|
|
Perform comprehensive security assessment: $ARGUMENTS
|
|
|
|
## Current Environment
|
|
|
|
- Dependency scan: !`npm audit --audit-level=moderate 2>/dev/null || pip check 2>/dev/null || echo "No package manager detected"`
|
|
- Environment files: @.env* (if exists)
|
|
- Security config: @.github/workflows/security.yml or @security/ (if exists)
|
|
- Recent commits: !`git log --oneline --grep="security\|fix" -10`
|
|
|
|
## Task
|
|
|
|
Perform systematic security audit following these steps:
|
|
|
|
1. **Environment Setup**
|
|
- Identify the technology stack and framework
|
|
- Check for existing security tools and configurations
|
|
- Review deployment and infrastructure setup
|
|
|
|
2. **Dependency Security**
|
|
- Scan all dependencies for known vulnerabilities
|
|
- Check for outdated packages with security issues
|
|
- Review dependency sources and integrity
|
|
- Use appropriate tools: `npm audit`, `pip check`, `cargo audit`, etc.
|
|
|
|
3. **Authentication & Authorization**
|
|
- Review authentication mechanisms and implementation
|
|
- Check for proper session management
|
|
- Verify authorization controls and access restrictions
|
|
- Examine password policies and storage
|
|
|
|
4. **Input Validation & Sanitization**
|
|
- Check all user input validation and sanitization
|
|
- Look for SQL injection vulnerabilities
|
|
- Identify potential XSS (Cross-Site Scripting) issues
|
|
- Review file upload security and validation
|
|
|
|
5. **Data Protection**
|
|
- Identify sensitive data handling practices
|
|
- Check encryption implementation for data at rest and in transit
|
|
- Review data masking and anonymization practices
|
|
- Verify secure communication protocols (HTTPS, TLS)
|
|
|
|
6. **Secrets Management**
|
|
- Scan for hardcoded secrets, API keys, and passwords
|
|
- Check for proper secrets management practices
|
|
- Review environment variable security
|
|
- Identify exposed configuration files
|
|
|
|
7. **Error Handling & Logging**
|
|
- Review error messages for information disclosure
|
|
- Check logging practices for security events
|
|
- Verify sensitive data is not logged
|
|
- Assess error handling robustness
|
|
|
|
8. **Infrastructure Security**
|
|
- Review containerization security (Docker, etc.)
|
|
- Check CI/CD pipeline security
|
|
- Examine cloud configuration and permissions
|
|
- Assess network security configurations
|
|
|
|
9. **Security Headers & CORS**
|
|
- Check security headers implementation
|
|
- Review CORS configuration
|
|
- Verify CSP (Content Security Policy) settings
|
|
- Examine cookie security attributes
|
|
|
|
10. **Reporting**
|
|
- Document all findings with severity levels (Critical, High, Medium, Low)
|
|
- Provide specific remediation steps for each issue
|
|
- Include code examples and file references
|
|
- Create an executive summary with key recommendations
|
|
|
|
Use automated security scanning tools when available and provide manual review for complex security patterns. |