| name | Source Code Security Patterns |
| description | This skill should be used when analyzing discovered source code for security issues.
Helps identify dangerous functions, hardcoded secrets, and vulnerable packages.
|
| version | 1.0.0 |
Source Code Security Patterns
Discovery Endpoints
Common backup/source locations to check:
- /download, /backup, /backup.zip
- /source.zip, /app.zip, /.git/
- *.bak, *.old files
Dangerous Patterns by Language
Python
| Pattern | Risk | Notes |
|---|
| js2py with user input | Critical | Check CVE-2024-28397 |
| yaml.load() no Loader | Critical | Use safe_load |
| subprocess shell=True | High | Command injection |
| render_template_string | High | SSTI |
| debug=True in Flask | Medium | Debugger access |
| Hardcoded secret_key | High | Session forgery |
PHP
| Pattern | Risk | Notes |
|---|
| system/passthru/shell calls | Critical | Command injection |
| include with variable | Critical | LFI/RFI |
| unserialize user data | Critical | Object injection |
Node.js
| Pattern | Risk | Notes |
|---|
| spawn/run with user input | High | Command injection |
| vm.runIn* functions | High | Sandbox escape |
| SQL string concatenation | High | SQL injection |
Search for Secrets
grep -rniE "(password|secret|token|api.?key)\s*[:=]" .
grep -rniE "(mysql|postgres|mongo)://" .
grep -rnl "PRIVATE KEY" .
find . -name ".env*"
Vulnerable Package Versions
Python (check requirements.txt)
- js2py <= 0.74: Sandbox escape CVE
- pyyaml < 5.4: Code execution
- flask < 2.0: Security fixes
- jinja2 < 2.11.3: Sandbox issues
Node.js (check package.json)
- lodash < 4.17.21: Prototype pollution
- serialize-javascript < 3.1.0: RCE
Quick Checklist
- Check framework and version
- Search for hardcoded secrets
- Review package versions for CVEs
- Find dangerous function calls
- Look for debug mode enabled
- Check for SQL string building
- Find serialization with user input
- Check template injection points
