Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

owasp-review

Étoiles2

Forks0

Mis à jour12 juillet 2026 à 12:09

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

YaoYinYing

YaoYinYing/REvoDesign

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".

Plus depuis ce dépôt

même dépôt

adversarial-verify

YaoYinYing/REvoDesign

Review a diff against the goal spec assuming the code is BROKEN. The reviewer that lives in the maker's head always agrees with itself — this pulls review into a hostile, separate pass. Invoke after every code change before marking work done.

2026-07-122

authz-check

YaoYinYing/REvoDesign

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

2026-07-122

bisect-regression

YaoYinYing/REvoDesign

Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.

2026-07-122

changelog-from-diff

YaoYinYing/REvoDesign

Turn a set of commits or a diff into a clean, user-facing changelog entry. Use before a release or PR description.

2026-07-122

clean-commits

YaoYinYing/REvoDesign

Turn messy WIP into clean, atomic commits with messages that explain why. Use before opening a PR.

2026-07-122

context-budget

YaoYinYing/REvoDesign

Keep the agent's context lean so accuracy doesn't collapse. Use on long sessions, big files, or when the agent starts hallucinating.

2026-07-122

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".