Run any Skill in Manus with one click

Get Started

security-review

Stars3

Forks0

UpdatedMarch 4, 2026 at 15:36

Run a security audit covering OWASP Top 10, deps, secrets, auth

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

YanCheng-go

YanCheng-go/danskprep

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Run a security audit covering OWASP Top 10, deps, secrets, auth
user-invocable	true

/security-review — Security Audit

Checks

1. Secret Scanning

Grep for patterns that should never be in code:

API keys, tokens, passwords in source files
.env files committed to git
Hardcoded credentials in config

2. Dependency Vulnerabilities

npm audit

Flag: CRITICAL and HIGH severity.

3. Auth & Authorization

RLS enabled on all user-data tables (if using Supabase/Postgres)
UPDATE policies have WITH CHECK (not just USING)
No privilege escalation paths

4. Client-Side Security

No secrets in localStorage or client-side code
No dangerouslySetInnerHTML without sanitization
No eval(), innerHTML, or new Function() with user input
CSP headers configured

5. Environment Variables

No VITE_ prefixed secrets (these are exposed to the client)
Service keys only used server-side
.env.example doesn't contain real values

6. Input Validation

User input validated at system boundaries
No SQL injection vectors (parameterized queries)
No XSS vectors (proper escaping)

Output Format

#	Severity	Category	Finding	File	Recommendation
1	CRITICAL	...	...	...	...

Severity: CRITICAL / HIGH / MEDIUM / LOW / INFO

More from this repository

same repository

backlog

YanCheng-go/danskprep

Manage the project backlog — add, list, filter, update, prioritize, and suggest work items

2026-03-053

daily

YanCheng-go/danskprep

Daily session wrapper — start with backlog, work, commit, retro

2026-03-053

retro

YanCheng-go/danskprep

End-of-session retrospective — summarize work, update backlog statuses, update MEMORY.md

2026-03-053

commit

YanCheng-go/danskprep

Commit, branch, PR, self-review, fix — then stop for human approval before merge

2026-03-053

parallel

YanCheng-go/danskprep

Pre-flight for parallel work — pick items, check file overlap, set statuses, generate terminal commands

2026-03-053

backlog

YanCheng-go/danskprep

Manage project backlog — add, list, filter, update, prioritize, suggest

2026-03-043

name	security-review
description	Run a security audit covering OWASP Top 10, deps, secrets, auth
user-invocable	true

/security-review — Security Audit

Checks

1. Secret Scanning

Grep for patterns that should never be in code:

API keys, tokens, passwords in source files
.env files committed to git
Hardcoded credentials in config

2. Dependency Vulnerabilities

npm audit

Flag: CRITICAL and HIGH severity.

3. Auth & Authorization

RLS enabled on all user-data tables (if using Supabase/Postgres)
UPDATE policies have WITH CHECK (not just USING)
No privilege escalation paths

4. Client-Side Security

No secrets in localStorage or client-side code
No dangerouslySetInnerHTML without sanitization
No eval(), innerHTML, or new Function() with user input
CSP headers configured

5. Environment Variables

No VITE_ prefixed secrets (these are exposed to the client)
Service keys only used server-side
.env.example doesn't contain real values

6. Input Validation

User input validated at system boundaries
No SQL injection vectors (parameterized queries)
No XSS vectors (proper escaping)

Output Format

#	Severity	Category	Finding	File	Recommendation
1	CRITICAL	...	...	...	...

Severity: CRITICAL / HIGH / MEDIUM / LOW / INFO