A command for reviewing code for common security weaknesses, using the OWASP checklist. OWASP is a group that publishes widely used guidance for web application security.

Use it to inspect application code, authentication, access checks, encryption, error handling, security settings, dependencies, and security logging.

It helps find risks such as injection, weak login handling, exposed sensitive data, cross-site scripting, and unsafe dependencies before they cause problems.

security — Command for coding agents by xu-xiang: A command for reviewing code for common security weaknesses…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/xu-xiang/everything-claude-code-zh/security

Clone the repo

git clone --depth 1 https://github.com/xu-xiang/everything-claude-code-zh

Or install everything-claude-code-zh, the plugin that ships this one along with the rest of its 17 skills, 26 commands, 13 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/xu-xiang/everything-claude-code-zh/security.svg)](https://agentmods.dev/commands/xu-xiang/everything-claude-code-zh/security)

Your own site

<a href="https://agentmods.dev/commands/xu-xiang/everything-claude-code-zh/security"><img src="https://agentmods.dev/badge/commands/xu-xiang/everything-claude-code-zh/security.svg" alt="Measured on agentmods" height="20"></a>

Per session 10 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 700 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00010	$0.00700
Opus 5	$0.00005	$0.00350
Sonnet 5	$0.00002	$0.00140
Haiku 4.5	$0.00001	$0.00070

Measured 4d ago against content hash cb4a07b70a27, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.opencode/commands/security.md · 90 lines

What it actually says

安全审查命令 (Security Review Command)

执行全面的安全审查：$ARGUMENTS

你的任务 (Your Task)

根据 OWASP 指南和安全最佳实践，分析指定代码中的安全漏洞。

安全检查清单 (Security Checklist)

OWASP Top 10

注入 (Injection) (SQL, NoSQL, OS 命令, LDAP)
- 检查参数化查询 (Parameterized Queries)
- 验证输入清理 (Input Sanitization)
- 审查动态查询构建
身份验证损坏 (Broken Authentication)
- 密码存储 (bcrypt, argon2)
- 会话管理 (Session Management)
- 多因素身份验证 (MFA)
- 密码重置流程
敏感数据泄露 (Sensitive Data Exposure)
- 静态与传输中的加密 (Encryption at rest and in transit)
- 妥善的密钥管理 (Key Management)
- PII (个人可识别信息) 处理
XML 外部实体 (XXE)
- 禁用 DTD 处理
- 对 XML 进行输入验证
失效的访问控制 (Broken Access Control)
- 在每个端点进行授权检查
- 基于角色的访问控制 (RBAC)
- 资源所有权验证
安全配置错误 (Security Misconfiguration)
- 移除默认凭据 (Default Credentials)
- 错误处理不泄露信息
- 配置安全标头 (Security Headers)
跨站脚本 (XSS)
- 输出编码 (Output Encoding)
- 内容安全策略 (CSP)
- 输入清理 (Input Sanitization)
不安全的反序列化 (Insecure Deserialization)
- 验证序列化数据
- 实施完整性检查
使用具有已知漏洞的组件 (Using Components with Known Vulnerabilities)
- 运行 npm audit
- 检查过时的依赖项
日志记录和监控不足 (Insufficient Logging & Monitoring)
- 记录安全事件
- 日志中不含敏感数据
- 配置告警 (Alerting)

其他检查项 (Additional Checks)

代码中的密钥/凭据 (API 密钥, 密码)
环境变量处理
CORS 配置
速率限制 (Rate Limiting)
CSRF 防护
安全 Cookie 标志 (Secure Cookie Flags)

报告格式 (Report Format)

严重问题 (Critical Issues)

[必须立即修复的问题]

高优先级 (High Priority)

[应在发布前修复的问题]

建议 (Recommendations)

[建议考虑的安全改进]

重要提示：安全问题属于阻塞性问题 (Blockers)。在严重问题解决之前，请勿继续。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 90 lines · 10 tokens per session scan A cb4a07b70a27

Subscribe to this mod's changes

security is a command published in the GitHub repository xu-xiang/everything-claude-code-zh (1,927 stars, last pushed 6mo ago), licensed MIT. It adds 10 tokens to every session and 700 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

LLM Security ai-agents anthropic claude claude-code developer-tools

security

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

安全审查命令 (Security Review Command)

你的任务 (Your Task)

安全检查清单 (Security Checklist)

OWASP Top 10

其他检查项 (Additional Checks)

报告格式 (Report Format)

严重问题 (Critical Issues)

高优先级 (High Priority)

建议 (Recommendations)

What this file has done since we first saw it

Other commands, from other repositories

awesome-chatgpt

init

commit

doctor.es

requirement-review

claude-request