Skip to main content
vuln-patterns-languages Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities.
Aller à l'installation Skills Marketplace Découvrez et explorez les compétences IA créées par la communauté.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Afficher les détails du prompt Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/Zate/cc-plugins --skill vuln-patterns-languagesLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Télécharger Zip Téléchargement... Métiers associés SOC
Basé sur la classification professionnelle SOC
name vuln-patterns-languages description Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities.
Vulnerability Patterns: Language-Specific
Detection patterns organized by programming language.
When to Use This Skill
Language-targeted scans - When auditing specific tech stacksCode review - Finding vulnerabilities in PRsBuilding auditor agents - Patterns for domain auditors
When NOT to Use This Skill
Universal patterns - Use vuln-patterns-core skillFull audits - Use domain auditor agentsRemediation - Use remediation-* skills
JavaScript/TypeScript Patterns
Dangerous eval()
Detection Pattern :
# eval with variables
eval\s*\([^)]*[a-zA-Z_]+[^)]*\)
# Function constructor
new\s+Function\s*\([^)]*[a-zA-Z_]+
# setTimeout/setInterval with string
(setTimeout|setInterval)\s*\([^,)]*['"`]
Grep Commands :
grep -rn --include="*.{js,ts}" -E "eval\s*\(" .
grep -rn --include="*.{js,ts}" -E "new\s+Function\s*\(" .
grep -rn --include="*.{js,ts}" -E "(setTimeout|setInterval)\s*\(['\"\`]" .
Severity : Critical
ASVS : V1.5.1 - Safe deserialization
CWE : CWE-94 (Code Injection)
XSS via DOM Manipulation
# innerHTML assignment
\.innerHTML\s*=(?!\s*['"]<[^>]+>[^<]*</[^>]+>['"])
# document.write
document\.write\s*\(
# insertAdjacentHTML
\.insertAdjacentHTML\s*\(
# React dangerouslySetInnerHTML
dangerouslySetInnerHTML
grep -rn --include="*.{js,ts,jsx,tsx}" "\.innerHTML\s*=" .
grep -rn --include="*.{js,ts,jsx,tsx}" "document\.write" .
grep -rn --include="*.{js,ts,jsx,tsx}" "dangerouslySetInnerHTML" .
Severity : High
ASVS : V3.3.1 - XSS prevention
CWE : CWE-79 (Cross-site Scripting)
Prototype Pollution # Direct __proto__ access
__proto__
# Object merge without validation
Object\.assign\s*\([^)]*,[^)]*\)
\.\.\.(?!props)[a-zA-Z_]+
# Bracket notation with variable
\[[a-zA-Z_]+\]\s*=
grep -rn --include="*.{js,ts}" "__proto__" .
grep -rn --include="*.{js,ts}" "constructor\s*\[" .
Severity : High
ASVS : V1.5.1 - Safe deserialization
CWE : CWE-1321 (Prototype Pollution)
Insecure Randomness Context : Only flag when used for security purposes (tokens, keys, IDs)
grep -rn --include="*.{js,ts}" "Math\.random" .
Severity : Medium (context-dependent)
ASVS : V11.3.1 - CSPRNG for security values
CWE : CWE-330 (Insufficient Randomness)
Missing Security Headers (Express) # Express without helmet
app\s*=\s*express\s*\(\)(?!.*helmet)
grep -rn --include="*.{js,ts}" "express()" . | grep -v helmet
grep -rn --include="*.{js,ts}" "helmet" .
Severity : Medium
ASVS : V3.4.1 - Security headers
CWE : CWE-693 (Protection Mechanism Failure)
Python Patterns
Unsafe Deserialization # Pickle with untrusted data
pickle\.(loads?|load)\s*\(
# YAML unsafe load
yaml\.(load|unsafe_load)\s*\([^)]*(?!Loader\s*=\s*yaml\.SafeLoader)
# Marshal load
marshal\.loads?\s*\(
grep -rn --include="*.py" "pickle\.load" .
grep -rn --include="*.py" "yaml\.load" . | grep -v "SafeLoader\|safe_load"
grep -rn --include="*.py" "marshal\.load" .
Severity : Critical
ASVS : V1.5.1 - Safe deserialization
CWE : CWE-502 (Deserialization of Untrusted Data)
Weak Cryptography # MD5/SHA1 for security
hashlib\.(md5|sha1)\s*\(
# DES/RC4
DES\.|RC4\.|Blowfish\.
# ECB mode
\.MODE_ECB
grep -rn --include="*.py" "hashlib\.md5\|hashlib\.sha1" .
grep -rn --include="*.py" "MODE_ECB" .
grep -rn --include="*.py" -E "DES\.|RC4\." .
Severity : High
ASVS : V11.5.2 - No MD5/SHA1
CWE : CWE-327 (Broken Crypto Algorithm)
Insecure Random # random module for security
random\.(choice|randint|random|randrange|sample)\s*\(
Context : Flag when used for tokens, keys, session IDs
grep -rn --include="*.py" -E "random\.(choice|randint|random|randrange)" . | grep -i "token\|key\|session\|secret\|password"
Severity : High
ASVS : V11.3.1 - CSPRNG
CWE : CWE-338 (Weak PRNG)
Hardcoded Flask Secret Key SECRET_KEY\s*=\s*['"][^'"]+['"]
app\.secret_key\s*=\s*['"][^'"]+['"]
grep -rn --include="*.py" "SECRET_KEY\s*=\s*['\"]" .
grep -rn --include="*.py" "secret_key\s*=\s*['\"]" .
Severity : High
ASVS : V13.3.1 - Secrets management
CWE : CWE-798 (Hardcoded Credentials)
Debug Mode in Production DEBUG\s*=\s*True
app\.run\s*\([^)]*debug\s*=\s*True
FLASK_DEBUG\s*=\s*['"]?1
grep -rn --include="*.py" "DEBUG\s*=\s*True" .
grep -rn --include="*.py" "debug\s*=\s*True" .
Severity : High
ASVS : V13.2.1 - Debug disabled in production
CWE : CWE-489 (Active Debug Code)
TLS Verification Disabled verify\s*=\s*False
REQUESTS_CA_BUNDLE\s*=\s*['"]?$
urllib3\.disable_warnings
grep -rn --include="*.py" "verify\s*=\s*False" .
grep -rn --include="*.py" "disable_warnings" .
Severity : High
ASVS : V12.3.1 - Certificate validation
CWE : CWE-295 (Improper Certificate Validation)
Go Patterns
SQL Injection # fmt.Sprintf in queries
fmt\.Sprintf\s*\([^)]*SELECT
db\.(Query|Exec)\s*\([^)]*\+
# String concatenation
"SELECT.*"\s*\+
grep -rn --include="*.go" -E "fmt\.Sprintf.*SELECT|fmt\.Sprintf.*INSERT" .
grep -rn --include="*.go" -E "db\.(Query|Exec)\s*\(.*\+" .
Severity : Critical
ASVS : V1.2.1 - Parameterized queries
CWE : CWE-89 (SQL Injection)
Weak Cryptography crypto/md5
crypto/sha1
crypto/des
crypto/rc4
grep -rn --include="*.go" "crypto/md5\|crypto/sha1\|crypto/des\|crypto/rc4" .
Severity : High
ASVS : V11.5.2 - No deprecated algorithms
CWE : CWE-327 (Broken Crypto)
Insecure TLS Config InsecureSkipVerify\s*:\s*true
MinVersion\s*:\s*tls\.VersionSSL
MinVersion\s*:\s*tls\.VersionTLS10
grep -rn --include="*.go" "InsecureSkipVerify.*true" .
grep -rn --include="*.go" "MinVersion.*SSL\|MinVersion.*TLS10\|MinVersion.*TLS11" .
Severity : High
ASVS : V12.2.1 - TLS 1.2+
CWE : CWE-295 (Certificate Validation)
Java Patterns
SQL Injection # String concatenation
Statement\s+\w+\s*=.*createStatement
executeQuery\s*\([^?]*\+
"SELECT.*"\s*\+
# PreparedStatement misuse
prepareStatement\s*\([^?]*\+
grep -rn --include="*.java" "createStatement" .
grep -rn --include="*.java" -E "executeQuery\s*\(.*\+" .
grep -rn --include="*.java" -E "\"SELECT.*\"\s*\+" .
Severity : Critical
ASVS : V1.2.1 - Parameterized queries
CWE : CWE-89 (SQL Injection)
Unsafe Deserialization ObjectInputStream
readObject\s*\(\)
XMLDecoder
XStream(?!.*allowTypes)
grep -rn --include="*.java" "ObjectInputStream\|readObject()" .
grep -rn --include="*.java" "XMLDecoder" .
Severity : Critical
ASVS : V1.5.1 - Safe deserialization
CWE : CWE-502 (Deserialization)
XXE Vulnerability DocumentBuilderFactory(?!.*setFeature.*FEATURE_SECURE)
SAXParserFactory(?!.*setFeature)
XMLInputFactory(?!.*setProperty.*SUPPORT_DTD)
grep -rn --include="*.java" "DocumentBuilderFactory\|SAXParserFactory\|XMLInputFactory" .
Severity : High
ASVS : V1.5.1 - XML processing
CWE : CWE-611 (XXE)
Weak Cryptography MessageDigest\.getInstance\s*\(\s*["']MD5
MessageDigest\.getInstance\s*\(\s*["']SHA-?1
Cipher\.getInstance\s*\(\s*["']DES
Cipher\.getInstance\s*\(\s*["'].*ECB
grep -rn --include="*.java" -E "MessageDigest\.getInstance.*MD5|MessageDigest\.getInstance.*SHA.?1" .
grep -rn --include="*.java" "Cipher\.getInstance.*DES\|Cipher\.getInstance.*ECB" .
Severity : High
ASVS : V11.5.2 - Secure algorithms
CWE : CWE-327 (Broken Crypto)
Ruby Patterns
Command Injection `[^`]*#{
system\s*\([^)]*#{
exec\s*\([^)]*#{
%x\{[^}]*#{
grep -rn --include="*.rb" -E "\`.*#\{" .
grep -rn --include="*.rb" -E "system\s*\(.*#\{" .
grep -rn --include="*.rb" "%x{" .
Severity : Critical
ASVS : V1.2.3 - Command injection
CWE : CWE-78 (OS Command Injection)
SQL Injection (Rails) \.where\s*\([^)]*#{
\.find_by_sql\s*\([^)]*#{
\.execute\s*\([^)]*#{
\.order\s*\([^)]*#{
grep -rn --include="*.rb" -E "\.where\s*\(.*#\{" .
grep -rn --include="*.rb" "find_by_sql" .
Severity : Critical
ASVS : V1.2.1 - Parameterized queries
CWE : CWE-89 (SQL Injection)
Mass Assignment attr_accessible\s*:
params\.permit!
\.update_attributes?\s*\(params
grep -rn --include="*.rb" "params\.permit!" .
grep -rn --include="*.rb" "update_attributes.*params" .
Severity : High
ASVS : V2.2.1 - Input validation
CWE : CWE-915 (Mass Assignment)
PHP Patterns
SQL Injection mysql_query\s*\(
mysqli_query\s*\([^,]+,\s*["'][^?]
\$_(?:GET|POST|REQUEST)\s*\[.*\]\s*\.
grep -rn --include="*.php" "mysql_query\|mysqli_query" .
grep -rn --include="*.php" '\$_(GET|POST|REQUEST).*\.' .
Severity : Critical
ASVS : V1.2.1 - Parameterized queries
CWE : CWE-89 (SQL Injection)
Command Injection (system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*\$
`\$
grep -rn --include="*.php" -E "(system|exec|shell_exec|passthru)\s*\(\s*\\\$" .
Severity : Critical
ASVS : V1.2.3 - Command injection
CWE : CWE-78 (OS Command Injection)
Unsafe Deserialization grep -rn --include="*.php" "unserialize\s*(\s*\$" .
Severity : Critical
ASVS : V1.5.1 - Safe deserialization
CWE : CWE-502 (Deserialization)
File Inclusion (include|require|include_once|require_once)\s*\(\s*\$
grep -rn --include="*.php" -E "(include|require)(_once)?\s*\(\s*\\\$" .
Severity : Critical
ASVS : V5.3.1 - File security
CWE : CWE-98 (File Inclusion)
Quick Reference by Language Language Critical Issues High Issues JS/TS eval(), XSS Prototype pollution Python pickle, yaml.load MD5/SHA1, random Go fmt.Sprintf SQL InsecureSkipVerify Java ObjectInputStream, SQL XXE, MD5/SHA1 Ruby backticks, SQL Mass assignment PHP unserialize, include mysql_query
See Also
vuln-patterns-core - Universal patternsremediation-injection - Injection fixesremediation-crypto - Crypto fixes 