القائمة
Use when: reviewing code for OWASP Top 10:2025 security findings with severity classification and a structured output format.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when running workspace tests, choosing a test command, or summarizing results before handoff to debugger.
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when the user wants to install or customize cursorAssistant in the current project (GitHub install or configure).
Use when: running pre-commit or pre-push CI-equivalent checks in any workspace — discovers workflow commands with Cursor tools, filters for local executability, scopes to staged changes, and runs checks cheapest-first.
Use when: discovering package manifests, assessing dependency health, finding replacements, or confirming import usage before removal — discovery only; mutating installs are handled by the deps agent.
| name | secureReview |
| description | Use when: reviewing code for OWASP Top 10:2025 security findings with severity classification and a structured output format. |
| type | reference |
| version | 1.0 |
| license | MIT |
Skill metadata: version "1.0"; tags [security, owasp, review]; recommended tools [].
Use this skill in workspaces with the secure pack selected.
Perform security-focused code review against the OWASP Top 10:2025. For each finding, map it to a specific OWASP category.
devopsReviewdependencyAudit| ID | Category | Common patterns to look for |
|---|---|---|
| A01 | Broken Access Control | Missing authorization checks, IDOR, path traversal, privilege escalation |
| A02 | Security Misconfiguration | Default credentials, overly permissive CORS, debug endpoints in production, unnecessary features enabled |
| A03 | Software Supply Chain Failures | Unpinned dependencies, unsigned artifacts, build system trust issues |
| A04 | Cryptographic Failures | Plaintext sensitive data, weak algorithms (MD5/SHA1 for secrets), hardcoded keys, insufficient key length |
| A05 | Injection | SQL injection, command injection, LDAP injection, template injection, XSS |
| A06 | Insecure Design | Missing rate limiting, no fraud controls, unsafe business logic, design decisions that assume trust |
| A07 | Authentication Failures | Weak password policy, missing MFA, session fixation, predictable session tokens |
| A08 | Software or Data Integrity Failures | Deserialization of untrusted data, unsigned updates, missing integrity checks |
| A09 | Security Logging and Alerting Failures | No audit trail, logging sensitive data, no alerting on critical events |
| A10 | Mishandling of Exceptional Conditions | Stack traces exposed to users, unsafe exception paths, resource leaks on error |
Produce a table for every code review:
| Severity | OWASP | File:Line | Finding | Recommended fix |
|---|
When writing new code (not reviewing), apply these without annotation unless they expand scope:
Do not report findings that are purely stylistic, have no security relevance, or require access to runtime configuration you cannot see. Speculation is not a finding.
Use these prefixes when giving code review feedback:
critical: — Critical severity finding (A01–A10)high: — High severity findingmedium: — Medium severity findinglow: — Low severity finding, accepted risk, or informationalnit: — Style or formatting issue with no security relevance