netsuite-suitescript-secure-code-review-skill

name	netsuite-suitescript-secure-code-review-skill
description	Flashlight skill for static security review of SuiteScript 2.x code against OWASP Top 10 (2021) pitfall patterns (OSCP-001 through OSCP-048), extended with Vanguard severity taxonomy mapping and CI pipeline gate recommendations. Adapted from Oracle netsuite-owasp-secure-coding (UPL-1.0). T0 static review — no live account connection required. TRIGGER when: user submits SuiteScript 2.x code for security review, asks about SuiteQL injection prevention, output encoding in Suitelets or RESTlets, CSRF in SuiteScript, file upload security, RESTlet hardening, DOM XSS in client scripts, postMessage origin validation, or AI prompt-injection in SuiteScript. Trigger phrases: SuiteScript security review, OWASP SuiteScript, SuiteQL injection, XSS in Suitelet, RESTlet hardening, CSRF token SuiteScript, file upload SuiteScript, OSCP vulnerability, secure coding SuiteScript. DO NOT TRIGGER when: request is for SuiteScript 1.0 (recommend migration first), SuiteFlow workflow logic review (use netsuite-suiteflow-automation-agent), OAuth 2.0 authentication setup (use netsuite-sso-oauth-tba-agent), role and permission configuration (use netsuite-identity-access-role-permission-agent), or live code execution or deployment is required (use netsuite-live-org-mutation-guard-agent).
license	UPL-1.0
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-06-09","category":"security","lifecycle":"experimental","execution_tier":"static-review","mcp_servers":[],"oauth_scopes":[],"run_as_permissions":{"required":[],"denied":[]}}

NetSuite SuiteScript Secure Code Review Skill

Purpose

Reviews SuiteScript 2.x code for the 48 catalogued OWASP-mapped pitfalls (OSCP-001 through OSCP-048) from the Oracle netsuite-owasp-secure-coding upstream skill, extended with Vanguard severity taxonomy mapping, CI pipeline gate thresholds, and audit evidence artifact format. Covers SuiteQL parameterization, LDAP escaping, HTML context output encoding, CSP construction, file upload/download pipelines, RESTlet API hardening, and AI prompt-injection mitigations. T0 static review — no NetSuite account connection required; output is a draft for human review.

When This Skill Owns the Task

• Developer submits SuiteScript 2.x code for pre-deployment security review
• CI pipeline gate triggers security scan on a pull request containing SuiteScript changes
• Security team needs OWASP-mapped findings report for a SuiteScript codebase audit
• Compliance team needs audit evidence artifacts for a SuiteScript change-management workflow

Recommended Workflow

1. Step 1 — Collect sanitized inputs: request SuiteScript 2.x source files (no credentials), script type declaration, external input surface list, and custom module paths
2. Step 2 — Injection surface mapping: identify all points where external input enters SuiteQL queries, LDAP calls, or dynamic string construction; map to OSCP injection pitfall IDs
3. Step 3 — Output encoding review: check all Suitelet and RESTlet response construction for correct HTML context encoding across body, attribute, JavaScript, CSS, and URL contexts
4. Step 4 — CSP and CSRF review: verify Content-Security-Policy header presence in RESTlet/Suitelet responses; verify CSRF token presence in state-changing operations
5. Step 5 — File and API hardening: review file upload MIME validation, path traversal controls, RESTlet authentication enforcement, and error response sanitization
6. Step 6 — Client-side and AI safety: check for DOM XSS patterns (innerHTML, document.write), postMessage origin validation gaps, and AI prompt-injection mitigations
7. Step 7 — Emit findings report: each finding maps to an OSCP pitfall ID (or [VANGUARD-EXTENDED]), rated Critical / High / Medium / Low with CI gate recommendation (block / warn / allow) and remediation guidance

Evidence Hierarchy

LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED

Safety Checklist

• No live NetSuite connection — all inputs are sanitized source code files
• No hardcoded credentials, API keys, consumer keys, or OAuth secrets in submitted code — refuse and instruct sanitization if found
• Administrator role is never recommended as a script run-as or deployment role
• Every finding maps to an OSCP pitfall ID or is explicitly labeled [VANGUARD-EXTENDED]