@wdyy/skills 0.1.27 → 0.1.30

package/.well-known/skills/wdyy-logging-standard/templates/logger.template.ts

@@ -1,9 +1,9 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { chmod, mkdir, open } from 'node:fs/promises';
-import type { FileHandle } from 'node:fs/promises';
+import { chmod, mkdir } from 'node:fs/promises';
 import { isIP } from 'node:net';
+import { Transform } from 'node:stream';
 
-export type LogType = 'access' | 'application' | 'security' | 'audit';
+export type LogType = 'request' | 'response' | 'security' | 'audit';
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
 export type LogResult = 'success' | 'failure';
 
@@ -80,16 +80,31 @@ export type TraceContext = {
   traceparent: string;
 };
 
+export type PinoRollStorageOptions = {
+  file: string;
+  size: string;
+  mode: number;
+  append: boolean;
+  mkdir: boolean;
+  dateFormat?: string;
+  limit?: { count?: number; removeOtherLogFiles?: boolean };
+};
+
 export const LOG_DIRECTORY = './logs' as const;
+export const LOG_DIRECTORY_MODE = 0o700;
+export const LOG_FILE_MODE = 0o600;
 export const MAX_LOG_FILE_SIZE_BYTES = 2 * 1024 * 1024;
+export const ROTATION_SIZE = '2m';
 export const MIN_NETWORK_LOG_RETENTION_MONTHS = 6;
 
+const DEPRECATED_LOG_TYPES = new Set(['access', 'application']);
+
 const REQUIRED_BY_TYPE: Record<LogType, readonly string[]> = {
-  access: [
+  request: [
     'traceId', 'method', 'route', 'sourceIp', 'actorId', 'actorType',
-    'functionCode', 'functionName', 'action', 'statusCode', 'result', 'durationMs',
+    'functionCode', 'functionName', 'action',
   ],
-  application: [],
+  response: ['traceId', 'method', 'route', 'statusCode', 'result', 'durationMs'],
   security: ['eventId', 'eventType', 'actorId', 'actorType', 'action', 'targetType', 'targetId', 'result'],
   audit: ['eventId', 'eventType', 'actorId', 'actorType', 'action', 'targetType', 'targetId', 'result'],
 };
@@ -200,14 +215,34 @@ export const formatTimezoneOffset = (date = new Date()): string => {
   return `${sign}${pad(Math.floor(absoluteMinutes / 60))}:${pad(absoluteMinutes % 60)}`;
 };
 
-export const createLogFileName = (date = new Date(), collisionIndex = 0): string => {
-  const baseName = formatLocalTimestamp(date).replace(' ', '_').replaceAll(':', '-');
-  return `${baseName}${collisionIndex > 0 ? `_${collisionIndex}` : ''}.log`;
+export const assertCstRuntime = (date = new Date()): void => {
+  if (formatTimezoneOffset(date) !== '+08:00') {
+    throw new Error('logging runtime timezone must be +08:00 (Asia/Shanghai)');
+  }
 };
 
-export const createLogFilePath = (date = new Date(), collisionIndex = 0): string => (
-  `${LOG_DIRECTORY}/${createLogFileName(date, collisionIndex)}`
-);
+const getRuntimeEnvironment = (): Record<string, string | undefined> => {
+  const runtime = globalThis as typeof globalThis & {
+    process?: { env?: Record<string, string | undefined> };
+  };
+  return runtime.process?.env ?? {};
+};
+
+export const createLogMixin = (
+  now: () => Date = () => new Date(),
+): (() => Record<string, unknown>) => () => {
+  const date = now();
+  assertCstRuntime(date);
+  const environment = getRuntimeEnvironment();
+  return {
+    timestamp: formatLocalTimestamp(date),
+    timestampEpochMs: date.getTime(),
+    timezone: '+08:00',
+    service: environment.SERVICE_NAME ?? 'backend',
+    instanceId: environment.INSTANCE_ID ?? 'local',
+    env: environment.NODE_ENV ?? 'development',
+  };
+};
 
 const TRACEPARENT_PATTERN = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
 const NON_ZERO_TRACE_ID = /[1-9a-f]/;
@@ -233,13 +268,6 @@ export const createTraceContext = (incomingTraceParent?: string): TraceContext =
   return { traceId, spanId, traceparent: `00-${traceId}-${spanId}-01` };
 };
 
-const getRuntimeEnvironment = (): Record<string, string | undefined> => {
-  const runtime = globalThis as typeof globalThis & {
-    process?: { env?: Record<string, string | undefined> };
-  };
-  return runtime.process?.env ?? {};
-};
-
 const isPresent = (value: unknown): boolean => (
   value !== undefined && value !== null && (typeof value !== 'string' || value.trim() !== '')
 );
@@ -338,6 +366,22 @@ const assertTraceId = (traceId: unknown): void => {
   }
 };
 
+export const assertSecurityAuditContext = (entry: LogContext): void => {
+  const requestFields = ['traceId', 'sourceIp', 'route', 'functionCode', 'functionName'] as const;
+  const presentRequestFields = requestFields.filter((key) => isPresent(entry[key]));
+  if (presentRequestFields.length > 0 && presentRequestFields.length !== requestFields.length) {
+    throw new Error(`Request-triggered ${entry.logType} logs require traceId, sourceIp, route, functionCode and functionName`);
+  }
+  if (presentRequestFields.length === requestFields.length) {
+    assertSourceIp(entry.sourceIp);
+    assertRouteTemplate(entry.route);
+    assertBusinessFunction(entry);
+  }
+  if (entry.result === 'failure' && !isPresent(entry.reason)) {
+    throw new Error(`Failed ${entry.logType} logs require reason`);
+  }
+};
+
 export const assertLogEntry = (entry: LogEntry): void => {
   const commonRequired = [
     'timestamp', 'timestampEpochMs', 'timezone', 'level', 'service', 'instanceId', 'env', 'logType', 'message',
@@ -351,15 +395,22 @@ export const assertLogEntry = (entry: LogEntry): void => {
     throw new Error('timestampEpochMs must be a positive safe integer');
   }
   if (entry.timezone !== '+08:00') throw new Error('timezone must be +08:00');
+  if (DEPRECATED_LOG_TYPES.has(entry.logType)) {
+    throw new Error(`Deprecated logType: ${entry.logType}`);
+  }
   if (!Object.hasOwn(REQUIRED_BY_TYPE, entry.logType)) throw new Error('Unknown logType');
 
   const typeMissing = REQUIRED_BY_TYPE[entry.logType].filter((key) => !isPresent(entry[key]));
   if (typeMissing.length) throw new Error(`Missing ${entry.logType} log fields: ${typeMissing.join(', ')}`);
-  if (entry.logType === 'access') {
+  if (entry.logType === 'request') {
     assertTraceId(entry.traceId);
     assertRouteTemplate(entry.route);
     assertSourceIp(entry.sourceIp);
     assertBusinessFunction(entry);
+  }
+  if (entry.logType === 'response') {
+    assertTraceId(entry.traceId);
+    assertRouteTemplate(entry.route);
     const expectedResult = resultForStatusCode(Number(entry.statusCode));
     if (!expectedResult || entry.result !== expectedResult) {
       throw new Error('statusCode and result must match');
@@ -369,19 +420,7 @@ export const assertLogEntry = (entry: LogEntry): void => {
     }
   }
   if (entry.logType === 'security' || entry.logType === 'audit') {
-    const requestFields = ['traceId', 'sourceIp', 'route', 'functionCode', 'functionName'] as const;
-    const presentRequestFields = requestFields.filter((key) => isPresent(entry[key]));
-    if (presentRequestFields.length > 0 && presentRequestFields.length !== requestFields.length) {
-      throw new Error(`Request-triggered ${entry.logType} logs require traceId, sourceIp, route, functionCode and functionName`);
-    }
-    if (presentRequestFields.length === requestFields.length) {
-      assertSourceIp(entry.sourceIp);
-      assertRouteTemplate(entry.route);
-      assertBusinessFunction(entry);
-    }
-  }
-  if ((entry.logType === 'security' || entry.logType === 'audit') && entry.result === 'failure' && !isPresent(entry.reason)) {
-    throw new Error('Failed security and audit logs require reason');
+    assertSecurityAuditContext(entry);
   }
   if (entry.traceId !== undefined) assertTraceId(entry.traceId);
   const forbiddenPath = findForbiddenLogFieldPath(entry);
@@ -396,14 +435,15 @@ export const toLogEntry = (
   additionalForbiddenNames: Iterable<string> = [],
 ): LogEntry => {
   const environment = getRuntimeEnvironment();
+  assertCstRuntime(date);
   const sanitizedContext = sanitizeLogValue(context, additionalForbiddenNames) as LogContext;
-  const statusResult = sanitizedContext.logType === 'access' && typeof sanitizedContext.statusCode === 'number'
+  const statusResult = sanitizedContext.logType === 'response' && typeof sanitizedContext.statusCode === 'number'
     ? resultForStatusCode(sanitizedContext.statusCode)
     : undefined;
   const entry = {
     timestamp: formatLocalTimestamp(date),
     timestampEpochMs: date.getTime(),
-    timezone: formatTimezoneOffset(date),
+    timezone: '+08:00',
     level,
     service: environment.SERVICE_NAME ?? 'backend',
     instanceId: environment.INSTANCE_ID ?? 'local',
@@ -418,73 +458,111 @@ export const toLogEntry = (
 
 const sha256 = (value: string): string => createHash('sha256').update(value).digest('hex');
 
-export class SecureLogWriter {
-  private currentHandle?: FileHandle;
-  private currentSize = 0;
-  private sequence = 0;
-  private previousHash: string | null = null;
-  private pending: Promise<void> = Promise.resolve();
-  private readonly chainId = randomUUID();
-  private readonly now: () => Date;
+export const createRolledLogFileName = (
+  baseFileName: string,
+  date = new Date(),
+  count = 1,
+): string => {
+  if (typeof baseFileName !== 'string' || !/^[a-z0-9][a-z0-9-]*$/i.test(baseFileName)) {
+    throw new Error('baseFileName must be a simple file name without path separators');
+  }
+  if (!Number.isSafeInteger(count) || count < 1) {
+    throw new Error('rotation count must be a positive integer');
+  }
+  const day = [date.getFullYear(), pad(date.getMonth() + 1), pad(date.getDate())].join('-');
+  return `${baseFileName}.${day}.${count}.log`;
+};
 
-  constructor(now: () => Date = () => new Date()) {
-    this.now = now;
+export const assertRolledLogFileName = (fileName: string): void => {
+  if (!/^[a-z0-9][a-z0-9-]*(?:\.\d{4}-\d{2}-\d{2})?(?:\.\d+)?\.log$/i.test(fileName)) {
+    throw new Error(`log file name must follow filename[.date][.count].log: ${fileName}`);
   }
+};
 
-  write(entry: LogEntry): Promise<StoredLogEntry> {
-    let storedEntry: StoredLogEntry | undefined;
-    const operation = this.pending.then(async () => {
-      storedEntry = await this.writeNow(entry);
-    });
-    this.pending = operation;
-    return operation.then(() => storedEntry as StoredLogEntry);
+export const createPinoRollTransportOptions = (baseFileName = 'backend') => ({
+  target: 'pino-roll',
+  options: {
+    file: `${LOG_DIRECTORY}/${baseFileName}`,
+    size: ROTATION_SIZE,
+    mode: LOG_FILE_MODE,
+    append: true,
+    mkdir: false,
+    dateFormat: 'yyyy-MM-dd',
+  } satisfies PinoRollStorageOptions,
+});
+
+export const assertPinoRollStorageOptions = (options: PinoRollStorageOptions): void => {
+  if (typeof options.file !== 'string' || !options.file.startsWith(`${LOG_DIRECTORY}/`)) {
+    throw new Error(`log file must be directly under ${LOG_DIRECTORY}`);
+  }
+  if (options.file.slice(LOG_DIRECTORY.length + 1).includes('/')) {
+    throw new Error('log subdirectories are not allowed');
   }
+  if (options.size !== ROTATION_SIZE) {
+    throw new Error(`rotation size must be ${ROTATION_SIZE}`);
+  }
+  if (options.mode !== LOG_FILE_MODE) {
+    throw new Error('new log files must use mode 0600');
+  }
+  if (options.append !== true) {
+    throw new Error('log files must be append-only');
+  }
+  if (options.mkdir !== false) {
+    throw new Error(`create ${LOG_DIRECTORY} with mode 0700 before logger initialization`);
+  }
+  if (options.limit?.removeOtherLogFiles === true) {
+    throw new Error('automatic removal of other log files is not allowed');
+  }
+  if (typeof options.limit?.count === 'number' && Number.isFinite(options.limit.count)) {
+    throw new Error('automatic deletion by file count is not allowed');
+  }
+};
 
-  async close(): Promise<void> {
-    await this.pending;
-    if (this.currentHandle) {
-      await this.currentHandle.close();
-      this.currentHandle = undefined;
-    }
+export const ensureLogDirectory = async (): Promise<void> => {
+  await mkdir(LOG_DIRECTORY, { recursive: true, mode: LOG_DIRECTORY_MODE });
+  await chmod(LOG_DIRECTORY, LOG_DIRECTORY_MODE);
+};
+
+export class HashChainTransform extends Transform {
+  private buffer = '';
+  private sequence = 0;
+  private previousHash: string | null = null;
+  private readonly chainId = randomUUID();
+
+  constructor() {
+    super({ objectMode: false });
   }
 
-  private async writeNow(entry: LogEntry): Promise<StoredLogEntry> {
+  applyChain(line: string): string {
+    const entry = JSON.parse(line) as LogEntry;
     assertLogEntry(entry);
     const sequence = this.sequence + 1;
     const unsigned = { ...entry, chainId: this.chainId, sequence, previousHash: this.previousHash };
     const entryHash = sha256(JSON.stringify(unsigned));
-    const storedEntry: StoredLogEntry = { ...unsigned, entryHash };
-    const serialized = `${JSON.stringify(storedEntry)}\n`;
-    const serializedBytes = Buffer.byteLength(serialized);
-
-    await this.ensureWritableFile(serializedBytes);
-    const handle = this.currentHandle;
-    if (!handle) throw new Error('Log file is not open after initialization');
-    await handle.appendFile(serialized, 'utf8');
-    this.currentSize += serializedBytes;
     this.sequence = sequence;
     this.previousHash = entryHash;
-    return storedEntry;
-  }
-
-  private async ensureWritableFile(nextEntryBytes: number): Promise<void> {
-    if (!this.currentHandle || this.currentSize + nextEntryBytes > MAX_LOG_FILE_SIZE_BYTES) {
-      if (this.currentHandle) await this.currentHandle.close();
-      this.currentHandle = undefined;
-      await mkdir(LOG_DIRECTORY, { recursive: true, mode: 0o700 });
-      await chmod(LOG_DIRECTORY, 0o700);
-      const date = this.now();
-      let collisionIndex = 0;
-      while (!this.currentHandle) {
-        const candidate = createLogFilePath(date, collisionIndex);
-        try {
-          this.currentHandle = await open(candidate, 'wx', 0o600);
-        } catch (error) {
-          if ((error as { code?: string }).code !== 'EEXIST') throw error;
-          collisionIndex += 1;
-        }
-      }
-      this.currentSize = 0;
+    return JSON.stringify({ ...unsigned, entryHash });
+  }
+
+  override _transform(
+    chunk: Buffer | string,
+    encoding: BufferEncoding,
+    callback: (error?: Error | null, data?: never) => void,
+  ): void {
+    this.buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+    let newlineIndex = this.buffer.indexOf('\n');
+    while (newlineIndex >= 0) {
+      const line = this.buffer.slice(0, newlineIndex);
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      if (line !== '') this.push(`${this.applyChain(line)}\n`);
+      newlineIndex = this.buffer.indexOf('\n');
     }
+    callback();
+  }
+
+  override _flush(callback: (error?: Error | null, data?: never) => void): void {
+    if (this.buffer !== '') this.push(`${this.applyChain(this.buffer)}\n`);
+    this.buffer = '';
+    callback();
   }
 }

package/.well-known/skills/wdyy-logging-standard/templates/nestjs-http-logging.middleware.template.ts

@@ -1,68 +1,90 @@
-import { Inject, Injectable, type NestMiddleware } from '@nestjs/common';
+import { Injectable, type NestMiddleware } from '@nestjs/common';
+import { LoggerModule } from 'nestjs-pino';
 import type { NextFunction, Request, Response } from 'express';
 import {
   BusinessFunctionCatalog,
   createTraceContext,
   requireSourceIp,
   resolveActorContext,
-  SecureLogWriter,
-  toLogEntry,
+  sanitizeLogValue,
   type TraceContext,
 } from './logger';
 
-export const BUSINESS_FUNCTION_CATALOG = Symbol('BUSINESS_FUNCTION_CATALOG');
-
 type LoggedRequest = Request & {
   traceContext?: TraceContext;
   user?: { id?: string; type?: string };
 };
 
-@Injectable()
-export class HttpLoggingMiddleware implements NestMiddleware {
-  constructor(
-    private readonly writer: SecureLogWriter,
-    @Inject(BUSINESS_FUNCTION_CATALOG)
-    private readonly functionCatalog: BusinessFunctionCatalog,
-  ) {}
+type LoggedResponse = Response & { responseTime?: number };
+
+const resolveRouteTemplate = (request: LoggedRequest): string => {
+  const routePath = request.route?.path;
+  return typeof routePath === 'string' ? `${request.baseUrl}${routePath}` : '';
+};
 
+const resultForStatusCode = (statusCode: number): 'success' | 'failure' => (
+  statusCode >= 100 && statusCode <= 399 ? 'success' : 'failure'
+);
+
+@Injectable()
+export class TraceContextMiddleware implements NestMiddleware {
   use(request: LoggedRequest, response: Response, next: NextFunction): void {
-    const incomingTraceParent = request.header('traceparent');
-    const trace = createTraceContext(incomingTraceParent);
+    const trace = createTraceContext(request.header('traceparent'));
     request.traceContext = trace;
     response.setHeader('traceparent', trace.traceparent);
     response.setHeader('x-trace-id', trace.traceId);
-    const startedAt = performance.now();
-
-    response.once('finish', () => {
-      const routePath = request.route?.path;
-      const route = typeof routePath === 'string'
-        ? `${request.baseUrl}${routePath}`
-        : '';
-      const businessFunction = this.functionCatalog.resolve(request.method, route);
-      const actor = resolveActorContext(request.user);
-      const sourceIp = requireSourceIp(request.ip || request.socket.remoteAddress);
-      const entry = toLogEntry('info', 'http request completed', {
-        logType: 'access',
-        traceId: trace.traceId,
-        spanId: trace.spanId,
-        parentSpanId: trace.parentSpanId,
-        ...actor,
-        ...businessFunction,
-        method: request.method,
-        route,
-        sourceIp,
-        userAgent: request.header('user-agent'),
-        query: request.query as Record<string, unknown>,
-        body: request.body,
-        statusCode: response.statusCode,
-        durationMs: Math.max(0, performance.now() - startedAt),
-      });
-
-      this.writer.write(entry).catch((error: unknown) => {
-        queueMicrotask(() => { throw error; });
-      });
-    });
-
     next();
   }
 }
+
+export const createNestPinoHttpOptions = (
+  stream: NodeJS.ReadableStream,
+  functionCatalog: BusinessFunctionCatalog,
+) => ({
+  stream,
+  level: 'info',
+  customProps: (request: LoggedRequest, response: LoggedResponse) => {
+    const route = resolveRouteTemplate(request);
+    const businessFunction = functionCatalog.resolve(request.method, route);
+    const actor = resolveActorContext(request.user);
+    const sourceIp = requireSourceIp(request.ip || request.socket.remoteAddress);
+    const trace = request.traceContext ?? createTraceContext(request.header('traceparent'));
+
+    const shared = {
+      traceId: trace.traceId,
+      spanId: trace.spanId,
+      parentSpanId: trace.parentSpanId,
+      method: request.method,
+      route,
+      sourceIp,
+      userAgent: request.header('user-agent'),
+      ...actor,
+      ...businessFunction,
+    };
+
+    if (!response.writableEnded) {
+      return {
+        ...shared,
+        logType: 'request',
+        query: sanitizeLogValue(request.query),
+        body: sanitizeLogValue(request.body),
+      };
+    }
+
+    return {
+      ...shared,
+      logType: 'response',
+      statusCode: response.statusCode,
+      result: resultForStatusCode(response.statusCode),
+      durationMs: response.responseTime ?? 0,
+      response: sanitizeLogValue(response.locals?.logResponse),
+    };
+  },
+});
+
+export const createNestHttpLoggingModule = (
+  stream: NodeJS.ReadableStream,
+  functionCatalog: BusinessFunctionCatalog,
+) => LoggerModule.forRoot({
+  pinoHttp: createNestPinoHttpOptions(stream, functionCatalog),
+});

package/.well-known/skills/wdyy-logging-standard/templates/pino-logger.template.ts

@@ -0,0 +1,38 @@
+import pino from 'pino';
+import {
+  assertPinoRollStorageOptions,
+  createLogMixin,
+  createPinoRollTransportOptions,
+  ensureLogDirectory,
+  HashChainTransform,
+  type PinoRollStorageOptions,
+} from './logger';
+
+export type SecurePinoLogger = {
+  logger: pino.Logger;
+  chain: HashChainTransform;
+  roll: ReturnType<typeof pino.transport>;
+};
+
+export const createSecurePinoLogger = async (
+  options: { baseFileName?: string } = {},
+): Promise<SecurePinoLogger> => {
+  const transportOptions = createPinoRollTransportOptions(options.baseFileName);
+  assertPinoRollStorageOptions(transportOptions.options as PinoRollStorageOptions);
+  await ensureLogDirectory();
+
+  const roll = pino.transport(transportOptions);
+  const chain = new HashChainTransform();
+  chain.pipe(roll);
+
+  const logger = pino(
+    {
+      base: null,
+      formatters: { level: (label) => ({ level: label }) },
+      mixin: createLogMixin(),
+    },
+    chain,
+  );
+
+  return { logger, chain, roll };
+};

package/.well-known/skills/wdyy-logging-standard/templates/security-audit-logger.template.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
-import { SecureLogWriter, toLogEntry, type LogResult } from './logger';
+import type { Logger } from 'pino';
+import { assertSecurityAuditContext, sanitizeLogValue, type LogContext, type LogResult } from './logger';
 
 export const REQUIRED_SECURITY_EVENTS = [
   'auth.login.success',
@@ -43,19 +44,13 @@ export type SecurityAuditEvent = {
 };
 
 export class SecurityAuditLogger {
-  constructor(private readonly writer: SecureLogWriter) {}
+  constructor(private readonly logger: Logger) {}
 
-  async record(event: SecurityAuditEvent): Promise<void> {
-    const requestFields = ['traceId', 'sourceIp', 'route', 'functionCode', 'functionName'] as const;
-    const presentRequestFields = requestFields.filter((field) => event[field] !== undefined && event[field] !== '');
-    if (presentRequestFields.length > 0 && presentRequestFields.length !== requestFields.length) {
-      throw new Error('Request-triggered security and audit events require traceId, sourceIp, route, functionCode and functionName');
-    }
-    const entry = toLogEntry(
-      event.result === 'failure' ? 'warn' : 'info',
-      event.eventType,
-      { ...event, eventId: randomUUID() },
-    );
-    await this.writer.write(entry);
+  record(event: SecurityAuditEvent): void {
+    const context: LogContext = { ...event, eventId: randomUUID() };
+    assertSecurityAuditContext(context);
+    const sanitized = sanitizeLogValue(context) as SecurityAuditEvent & { eventId: string };
+    const level = event.result === 'failure' ? 'warn' : 'info';
+    this.logger[level](sanitized, event.eventType);
   }
 }

package/.well-known/skills/wdyy-safety-review/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: wdyy-safety-review
+description: 对整个软件执行证据驱动的安全审核并生成四列 Markdown 检查清单。Use when 审查或设计身份认证与权限、Web/API、文件上传下载、敏感数据、源码与依赖、安全日志、漏洞扫描或漏洞验证；即使用户只说“安全检查”“代码安全”“接口安全”“扫描漏洞”也应使用本 Skill。
+disable-model-invocation: true
+---
+
+# 软件安全审核规范
+
+## 审核边界
+
+本 Skill 审核整个软件，按六类组织：身份认证与权限、Web/API 安全、文件安全、数据与敏感信息安全、代码与依赖安全、安全日志与漏洞验证。公网接口是 Web/API 类中的检查项，不是唯一或默认主范围。
+
+默认仅执行源码、配置、依赖清单、部署文件和已提供报告的只读审查。任何会向运行目标发送流量、改变状态或处理真实数据的扫描、漏洞验证或渗透测试，均须先由工程师明确确认：资产授权、目标、环境、允许技术、速率、时间窗、联系人、停止条件和证据处理规则。任一项缺失时停止主动测试，并在清单中标记 `未检查`。
+
+## 输入与确认项
+
+- 输入：代码仓库、技术栈、依赖清单与锁文件、部署配置、OpenAPI/接口文档、角色权限模型、数据分类、现有安全报告和运行证据。
+- 确认：审核范围、环境、数据处理边界、主动测试授权，以及发现项的责任人和整改期限。
+- 不得请求、回显或写入真实密码、Token、密钥、患者信息、身份证件或其他敏感数据；发现秘密时仅记录类型和脱敏位置。
+
+## 执行流程
+
+1. 盘点代码、服务、入口、角色、数据类型、文件处理链路、依赖、部署边界和已有安全控制；先列证据，再给结论。
+2. 完整阅读 [六类审核规则](references/security-review-rules.md)，按适用技术栈选择检查项；不适用必须说明技术事实。
+3. 检查身份认证与权限：登录、密码 Hash、Token/JWT、Session、验证码、失效、RBAC、接口权限，以及水平越权、垂直越权和未授权访问。
+4. 检查 Web/API 和文件：注入、XSS、CSRF、SSRF、路径遍历、参数篡改、重放、遍历、限流、异常泄露，及上传、下载、预览、导出的类型、大小、恶意文件、覆盖和越权。
+5. 检查数据与供应链：最小必要、脱敏、HTTPS、敏感字段返回、日志泄露、硬编码秘密、SAST、SCA、npm/Maven 漏洞、过期组件、SBOM、Git 秘密、危险函数和不安全配置。
+6. 检查安全日志与漏洞验证：登录失败、权限拒绝、数据修改、敏感操作的审计证据；日志实现或整改使用 `wdyy-logging-standard`。主动验证只在授权完整时执行，并保存最小化证据和复测结果。
+7. 复制 [安全检查清单模板](templates/security-checklist.template.md)，用真实证据填充后运行 `node scripts/validate-security-checklist.mjs <清单路径>`。
+
+## 结论规则
+
+- 结果只能为 `通过`、`不通过`、`未检查`、`不适用`。
+- `通过`：提供充分证据，修复方案写“无需修复”。
+- `不通过`：给出可执行的修复方案与验证方式。
+- `未检查`：说明缺少的证据、授权或执行条件；不得写成已经通过。
+- `不适用`：说明当前技术栈或功能范围为何不适用。
+- 扫描器结果需要结合可达性、数据流、数据敏感度和业务影响人工复核，不能直接等同最终风险结论。
+
+## 交付格式
+
+在范围和限制的简短说明后，输出一个 Markdown 表格；该表格只能使用以下四列，且六类检查均至少一项：
+
+| 检查类型 | 检查项目 | 检查结果 | 修复方案 |
+| --- | --- | --- | --- |
+
+检查项目中写脱敏后的证据位置；检查结果中写简短判定依据。不得增加“风险等级”“责任人”等表格列。
+
+## 验证
+
+- [ ] 所有结论关联真实、脱敏的证据位置；未执行项目均为 `未检查`。
+- [ ] 清单只有四列，覆盖六类检查，结果值与修复方案符合合同。
+- [ ] 主动扫描、漏洞验证或渗透测试具有完整授权；否则没有主动流量。
+- [ ] `node --test scripts/validate-security-checklist.test.mjs` 与清单校验器通过。

package/.well-known/skills/wdyy-safety-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "wdyy-safety-review"
+  short_description: "审核软件安全并生成四列整改清单"
+  default_prompt: "Use $wdyy-safety-review to review the whole software across identity and permissions, Web/API, files, sensitive data, dependencies, and security logging; produce an evidence-based four-column Markdown checklist."