Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

mcp-security-review

Sterne2

Forks0

Aktualisiert8. Juli 2026 um 04:02

Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

tvnkhoa

tvnkhoa/mcp-local

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.

Mehr aus diesem Repository

gleiches Repository

key

tvnkhoa/mcp-local

"Browse Bitbucket Cloud repositories and pull requests, read PR diffs, and create pull requests via the {{DISPLAY_NAME}}. Triggers on: list repos/branches/PRs, view a pull request or its diff, open/create a PR. PR creation is gated and supports dryRun."

2026-07-082

db-parameterization-audit

tvnkhoa/mcp-local

Audit SQL construction to ensure parameterized execution, anti-concatenation posture, and read-only safety.

2026-07-082

db-query-budgeting

tvnkhoa/mcp-local

Control DB query budget with timeout, row limits, and concurrency caps to prevent abuse and resource exhaustion.

2026-07-082

mcp-contract-conformance

tvnkhoa/mcp-local

Validate MCP contract stability for tools/list, tools/call, schemas, and backward compatibility before merge or release.

2026-07-082

mcp-error-taxonomy

tvnkhoa/mcp-local

Standardize MCP errors into user-actionable vs developer/internal classes with stable codes and safe messages.

2026-07-082

mcp-host-integration-security

tvnkhoa/mcp-local

Harden MCP host/client integration with token hygiene, scope minimization, transport safeguards, and policy checks.

2026-07-082

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.