Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

owasp-review

Sterne2

Forks0

Aktualisiert12. Juli 2026 um 12:09

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

YaoYinYing

YaoYinYing/REvoDesign

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".

Mehr aus diesem Repository

gleiches Repository

adversarial-verify

YaoYinYing/REvoDesign

Review a diff against the goal spec assuming the code is BROKEN. The reviewer that lives in the maker's head always agrees with itself — this pulls review into a hostile, separate pass. Invoke after every code change before marking work done.

2026-07-122

authz-check

YaoYinYing/REvoDesign

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

2026-07-122

bisect-regression

YaoYinYing/REvoDesign

Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.

2026-07-122

changelog-from-diff

YaoYinYing/REvoDesign

Turn a set of commits or a diff into a clean, user-facing changelog entry. Use before a release or PR description.

2026-07-122

clean-commits

YaoYinYing/REvoDesign

Turn messy WIP into clean, atomic commits with messages that explain why. Use before opening a PR.

2026-07-122

context-budget

YaoYinYing/REvoDesign

Keep the agent's context lean so accuracy doesn't collapse. Use on long sessions, big files, or when the agent starts hallucinating.

2026-07-122

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".