# Security Guardian

> 对鉴权、权限、输入处理、数据写入、依赖配置、密钥、日志和外部调用进行安全审计时使用。用户提到 security、auth、permission、vulnerability、secret、injection、审计登录逻辑、权限合规时都应触发。

- **Type:** Skill
- **Install:** `agentstack add skill-caomeiyouren-cmyr-skills-agents-security-guardian`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [CaoMeiYouRen](https://agentstack.voostack.com/s/caomeiyouren)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [CaoMeiYouRen](https://github.com/CaoMeiYouRen)
- **Source:** https://github.com/CaoMeiYouRen/cmyr-skills-agents/tree/master/skills/security-guardian

## Install

```sh
agentstack add skill-caomeiyouren-cmyr-skills-agents-security-guardian
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Guardian

铁律：把“没有看到明显校验”视为真实风险，直到证据证明它是安全的。

## 工作流

- [ ] Step 1: 标记敏感面 ⚠️ REQUIRED
	- [ ] 1.1 识别登录、会话、权限、数据写入、文件访问、外部请求和 secrets。
	- [ ] 1.2 标记涉及用户身份、租户边界和高价值数据的路径。
- [ ] Step 2: 逐类审计 ⚠️ REQUIRED
	- [ ] 2.1 查鉴权与授权是否完整。
	- [ ] 2.2 查输入处理是否存在注入、XSS、路径遍历或命令执行风险。
	- [ ] 2.3 查日志、配置和提交内容是否泄露 secrets。
	- [ ] 2.4 查依赖与默认配置是否存在危险默认值。
- [ ] Step 3: 评估影响
	- [ ] 3.1 明确可利用性、影响范围和修复优先级。
	- [ ] 3.2 不确定时说明需要人工核验的点，而不是轻率放行。

## 反模式

- 只扫 secrets，不审权限与输入处理。
- 看到 helper 名字像 requireAuth 就默认安全。
- 把“本地环境”“内部系统”当成可接受的安全豁免。

## 交付前检查

- [ ] 已覆盖鉴权、授权、输入、日志、配置和依赖几个维度。
- [ ] 每个高风险点都说明了利用方式或影响。
- [ ] 不确定的点已明确标注人工核验需求。
- [ ] 没有以环境或规模为理由弱化安全结论。

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [CaoMeiYouRen](https://github.com/CaoMeiYouRen)
- **Source:** [CaoMeiYouRen/cmyr-skills-agents](https://github.com/CaoMeiYouRen/cmyr-skills-agents)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-caomeiyouren-cmyr-skills-agents-security-guardian
- Seller: https://agentstack.voostack.com/s/caomeiyouren
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.