name: security-review description: Review code changes for security vulnerabilities. Checks for OWASP Top 10, secrets exposure, injection flaws, auth issues, and insecure defaults. Use when reviewing PRs, commits, or code diffs. triggers: - security review - check for vulnerabilities - secure code review - OWASP check

Security Code Review

Review code changes for security vulnerabilities, following OWASP Top 10 and secure coding best practices.

What to Check

Injection (SQL, Command, LDAP, XSS)

• User input used in queries without parameterization
• Template literals in SQL strings
• eval(), exec(), os.system() with user input
• Unescaped output in HTML templates

Authentication & Session

• Hardcoded credentials or API keys
• Weak password requirements
• Missing rate limiting on auth endpoints
• Session fixation or missing regeneration
• JWT without expiration or with weak signing

Authorization

• Missing access control checks on endpoints
• IDOR (direct object reference without ownership check)
• Role checks that can be bypassed
• Privilege escalation paths

Secrets & Data Exposure

• API keys, tokens, passwords in code or configs
• Sensitive data in logs
• PII without encryption
• .env files or secrets committed to git

Configuration

• Debug mode enabled in production
• CORS set to wildcard (*)
• Missing security headers
• Default credentials unchanged

  7w4.net小葱技能站收录全网优质技能，值得收藏。

• Verbose error messages exposing internals

Output Format

For each finding:

**FINDING:** [Title]
**Severity:** CRITICAL | HIGH | MEDIUM | LOW
**File:** [path:line]
**Code:** [the problematic code]
**Issue:** [what's wrong]
**Fix:** [how to fix it, with code example]
**OWASP:** [category reference]

Rules

• Focus on HIGH and CRITICAL findings first
• Provide working fix code, not just descriptions
• If no security issues found, say so clearly
• Note any areas that need manual review (business logic, auth flows)

这个 Skill 质量中等偏上，胜在检查范围全面、规则清晰，能覆盖常见的安全问题。不过它比较模板化，缺少灵活性，无法根据项目特点调整检查力度，也没有提供具体的代码示例供参考。对于想要快速进行安全检查的用户来说足够使用，但想要深度定制或处理复杂场景就会显得有些力不从心。