Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

Comenzar

secure-code-review

Estrellas42

Forks13

Actualizado26 de enero de 2026 a las 21:35

Repeatable process for an application security code review that produces prioritized findings and fix guidance.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

Robotti-io

Robotti-io/copilot-security-instructions

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Otras ocupaciones informáticasOcupaciones informáticas y matemáticas·SOC 15-1299

SKILL.md

readonly

name	secure-code-review
description	Repeatable process for an application security code review that produces prioritized findings and fix guidance.

Secure Code Review

When to use

Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.

Inputs to collect (if available)

What component(s) are in scope (API, UI, worker, infra scripts)
Data sensitivity (PII, auth/session, payments)
Deployment assumptions (internet-facing, internal, multi-tenant)
Any known incidents, CVEs, or audit requirements

Step-by-step process

Map entry points & trust boundaries
- Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
- Identify where untrusted input crosses into privileged actions or sensitive sinks.
Scan for high-risk classes
- Injection: SQL/NoSQL/LDAP/OS/template
- Authn/authz: missing checks, insecure defaults, confused deputy
- Deserialization & file handling: unsafe loads, path traversal, upload
- Crypto: homegrown crypto, weak randomness, token validation mistakes
- Logging: secrets/PII exposure, overly verbose errors
- SSRF: URL fetchers, webhook validation gaps
Deep-dive the highest impact areas
- Trace data flow from input → validation → authorization → sink.
- Look for missing allow-lists, type confusion, and implicit conversions.
Write findings in a consistent format
- Title, severity, confidence
- Where (file/function)
- Risk + prerequisites
- Repro steps
- Recommendation + verification steps
Close with a remediation plan
- Quick wins (hours), medium fixes (days), structural guardrails (weeks).

Output template

Summary

Scope reviewed:
Top issues:
Overall risk: Low / Medium / High / Critical

Findings (repeat)

Title
Severity / Confidence
Where
Risk
Repro
Recommendation
Verification

Repo integration (optional)

If this repo includes prompt files under /prompts, the following are commonly relevant:

secure-code-review.prompt.md
scan-for-insecure-apis.prompt.md
validate-input-handling.prompt.md
review-auth-flows.prompt.md

Más de este repositorio

mismo repositorio

access-control-review

Robotti-io/copilot-security-instructions

Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.

2026-04-1842

dependency-cve-triage

Robotti-io/copilot-security-instructions

Triage a dependency CVE using local repo evidence and remediation guidance.

2026-04-1842

threat-model

Robotti-io/copilot-security-instructions

Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.

2026-04-1842

access-control-review

Robotti-io/copilot-security-instructions

Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.

2026-04-1842

threat-model

Robotti-io/copilot-security-instructions

Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.

2026-04-1542

genai-acceptance-review

Robotti-io/copilot-security-instructions

Review workflow for AI/LLM output usage to prevent over-trust, injection, and unsafe automation.

2026-01-2642

Secure Code Review

When to use

Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.

Inputs to collect (if available)

What component(s) are in scope (API, UI, worker, infra scripts)

Data sensitivity (PII, auth/session, payments)

Deployment assumptions (internet-facing, internal, multi-tenant)

Any known incidents, CVEs, or audit requirements

Step-by-step process

Map entry points & trust boundaries

Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
Identify where untrusted input crosses into privileged actions or sensitive sinks.

Scan for high-risk classes

Injection: SQL/NoSQL/LDAP/OS/template
Authn/authz: missing checks, insecure defaults, confused deputy
Deserialization & file handling: unsafe loads, path traversal, upload
Crypto: homegrown crypto, weak randomness, token validation mistakes
Logging: secrets/PII exposure, overly verbose errors
SSRF: URL fetchers, webhook validation gaps

Deep-dive the highest impact areas

Trace data flow from input → validation → authorization → sink.
Look for missing allow-lists, type confusion, and implicit conversions.

Write findings in a consistent format

Title, severity, confidence
Where (file/function)
Risk + prerequisites
Repro steps
Recommendation + verification steps

Close with a remediation plan

Quick wins (hours), medium fixes (days), structural guardrails (weeks).

Output template

Summary

Scope reviewed:

Top issues:

Overall risk: Low / Medium / High / Critical

Findings (repeat)

Title

Severity / Confidence

Where

Risk

Repro

Recommendation

Verification

Repo integration (optional)

If this repo includes prompt files under /prompts, the following are commonly relevant:

secure-code-review.prompt.md

scan-for-insecure-apis.prompt.md

validate-input-handling.prompt.md

review-auth-flows.prompt.md