Communitygithub.com

lguidolin/纵深防御安全

在处理不受信任的输入、密钥、认证/授权或依赖项时，或对新的攻击面进行威胁建模时使用。关键词——STRIDE、威胁模型、最小权限、密钥管理、供应链、依赖扫描、输入验证、审计日志、纵深防御。

纵深防御安全 是什么？

此技能为 AI 辅助开发人员提供了一套基于纵深防御原则的安全指南。它强调安全是分层的，任何单层都可能失效，因此需要采用最小权限原则，确保即使某一层出现漏洞，系统仍能抵御攻击。该技能覆盖了从威胁建模（使用 STRIDE 框架）、密钥管理、输入验证、依赖供应链安全到敏感操作审计的完整安全生命周期。它适用于任何处理用户输入、密钥或敏感数据的开发场景，并提供了与特定技术栈（如 PostgreSQL RLS、GraphQL 限流、Azure Key Vault）相结合的实践指南。通过将此技能集成到 AI 工作流中，AI 代理能够在生成代码时自动检查安全最佳实践，例如在 CI 流水线中强制进行依赖审计、镜像扫描和密钥扫描，从而显著降低安全风险。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/lguidolin/agent-skills/tree/main/skills/defense-in-depth-security
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

纵深防御安全 是做什么的？

概述

安全是分层的，假定任何单层都可能失效，并授予能够工作的最小权限。攻击者总能找到你忽略的那一层——依赖单一墙的系统，当那面墙有一个 bug 就会倒塌；而重叠的最小权限控制能够在任何一个控制失效时幸存下来。

原则（通用）

  • 在构建任何处理不受信任输入、密钥或用户数据的内容之前，先进行威胁建模。 对每个新的攻击面执行一次轻量级的 STRIDE 检查（欺骗、篡改、抵赖、信息泄露、拒绝服务、权限提升）。记录模型和缓解措施（参见 recording-decisions）。
  • 纵深防御。 没有单一控制是“唯一的”安全措施。认证、授权、输入验证和数据层执行各自都假定其他控制可能被绕过。
  • 处处遵循最小权限原则——角色、令牌、服务账户、数据库授权。默认无权限；授予最少权限；撤销未使用的权限。
  • 密钥永远不应存在于代码、镜像或已提交的配置中。 它们应在运行时来自密钥存储，可轮换，且作用域仅限于需要它们的负载。
  • 在信任边界验证所有输入； 将每个外部系统的输出视为不受信任的数据，而不是指令。
  • 依赖供应链是一个攻击面。 锁定文件已提交并进行完整性检查；依赖项已扫描并更新；基础镜像已固定并扫描。
  • 敏感操作应被审计——谁在何时做了什么——以便可以重建滥用和错误行为。

快速参考

攻击面首要问题
接受用户输入的新端点STRIDE 模型是什么？验证在哪里？可工作的最小角色是什么？
任何涉及密钥的内容它是否在密钥存储中（而不是代码/镜像）？作用域是否合理？是否可轮换？
新的依赖项锁定文件是否已固定？已扫描？是否得到了良好支持？
特权变更操作是否已审计？执行者是否在数据层（而不仅仅是应用层）被授权？

技术栈机制

RLS 作为最终执行层，GraphQL 深度/成本限制作为 DoS 控制，Key Vault 用于密钥管理，CI 中的 pnpm audit/Trivy——参见 postgres-postgraphile-rls-and-sql 和 cloud-delivery-aks。

强制执行： CI 中的依赖审计 + 镜像扫描 + 密钥扫描（阻塞性）；威胁模型和审计覆盖率由评审者判断。

完整理由：参见汇编文件第 X 条和第 XIV 条，捆绑在 engineering-constitution/references/engineering-constitution.md 中。

Individual skills in this repo

This repo contains 18 individual skills — each has its own dedicated page.

lguidolin/change-hygiene-and-code-craft

Use when writing or refactoring code, structuring a commit or PR, or deciding whether to abstract duplication. Symptoms — mixing reorg with logic changes, a PR doing several things at once, a file growing large, the second copy of similar code, or unsure whether to DRY something up.

lguidolin/cloud-delivery-aks

Use when deploying to Kubernetes or Azure Kubernetes Service (AKS), configuring cloud secrets, setting up progressive rollout/canary, per-PR ephemeral environments, or k8s health probes. Keywords — Kubernetes, AKS, Key Vault, Argo Rollouts, Flagger, canary, blue-green, liveness, readiness, PodDisruptionBudget, HPA, rollback, GHCR.

lguidolin/commit-history-rewrite

Use when an existing repository has messy commit history that needs to conform to conventional commits before adopting release-please, or when intermediate WIP/fixup/merge commits need to be cleaned up.

lguidolin/conventional-commits-and-releases

Use when committing, writing a commit message, opening a PR that will be squash-merged, or configuring automated versioning/changelogs. Keywords — conventional commits, release-please, semver, feat/fix/chore, breaking change, changelog.

lguidolin/designing-before-building

Use when starting a feature, fixing a non-trivial bug, or about to write implementation code — before any code exists. Symptoms you need this: "this is simple, I'll just code it", reaching for the editor before a design is approved, or an idea that hasn't been turned into a spec and plan.

lguidolin/engineering-constitution

Use when starting work in a project that follows the engineering constitution, orienting to its rules, or deciding which engineering practice applies to a task — spec writing, commits, testing, security, deploys, database, or UI work.

lguidolin/graphql-contract-testing

Use when writing a GraphQL query/mutation that the UI and a test will share, or building route/schema contract or smoke tests. Symptoms — copying a query into a test, a test asserting on query text, schema change that didn't break the UI build, or RLS/permission drift. Keywords — graphql-codegen, typed document, contract test, route smoke test.

lguidolin/init-repo-CI

Use when setting up a new repository with conventional commits, release-please, and CI automation, or when retrofitting an existing repository that lacks automated versioning and PR validation workflows.

lguidolin/interface-craft-and-accessibility

Use when building or styling UI — components, layouts, forms, design tokens — or making accessibility decisions. Keywords — a11y, WCAG, keyboard navigation, focus state, contrast, design system, minimalist UI, component reuse, ARIA, semantic HTML.

lguidolin/merge-gates-and-automation

Use when setting up or changing CI, pre-push hooks, or a task runner, or deciding what must pass before merge. Symptoms — tempted to put authoritative checks only in a local hook, skip CI, bypass with --no-verify, or unsure what gates a merge vs. runs locally.

lguidolin/observability-and-slos

Use when adding logging, metrics, tracing, health checks, SLOs, or alerting — or when building a service surface that needs to be operable and debuggable. Keywords — structured logs, OpenTelemetry, correlation id, RED metrics, liveness, readiness, SLI, SLO, error budget, alerting.

lguidolin/performance-and-scale

Use when working on hot paths, list endpoints, pagination, data-access in loops, or public interfaces/schemas. Symptoms — unbounded queries, N+1 access, no latency budget, optimizing without measuring, or changing an interface many consumers depend on. Keywords — pagination, N+1, Hyrum's Law, performance budget, bundle size.

lguidolin/postgres-postgraphile-rls-and-sql

Use when writing PostgreSQL, PostGraphile config, Row-Level Security policies, SQL schema files, or working on the Browser→App→PostGraphile→Postgres data path. Keywords — RLS, SECURITY DEFINER, search_path, pgSettings, grants, roles, GraphQL depth limit, query cost, statement_timeout, SQL file organization.

lguidolin/recording-decisions

Use when a design or architecture decision has been made and needs to be captured — writing a decision record or ADR, updating a decision index, noting a deferred idea, or superseding a past decision. Keywords — ADR, decision record, rationale, rejected alternatives, dependency index.

lguidolin/resilience-and-deploy-safety

Use when planning a deploy, designing a rollback, or responding to an incident or writing a postmortem. Keywords — deploy safety, rollback, immutable artifact, progressive delivery, canary, blast radius, incident response, blameless postmortem, error budget.

lguidolin/ship-it

Use when the user wants to ship work — push, PR, archive decision records, merge, and clean up. Handles the full lifecycle from committing final changes through post-merge cleanup including converting specs/plans to compact decision records.

lguidolin/tests-as-a-control

Use when writing or modifying tests, when a test breaks during a refactor, or when testing permission/role rules. Symptoms — tempted to edit a test to make it pass, testing only the happy path, a deny-test that started passing, flaky tests, or unsure what to assert.

lguidolin/zero-downtime-migrations

Use when changing a database schema where data must survive the change — adding/removing/renaming columns, constraints, indexes, or backfilling. Symptoms — a destructive migration bundled with a code deploy, a NOT NULL column with a backfill, a table-locking UPDATE, or a rename. Keywords — expand/contract, parallel change, backfill, NOT VALID, CREATE INDEX CONCURRENTLY, graphile-migrate.

相关技能

steipete/sag

ElevenLabs text-to-speech with mac-style say UX.

community

steipete/oracle

Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.

community

steipete/peekaboo

Capture and automate macOS UI with the Peekaboo CLI.

community

mattpocock/design-an-interface

Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".

community

mattpocock/prototype

Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.

community

mattpocock/grill-me

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

community