Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

$pwd:

code-review-security

Name: Code Review Security
Author: OWASP

// Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.

Exécuter dans Manus

$ git log --oneline --stat

stars:78

forks:8

updated:17 mai 2026 à 20:08

SKILL.md

readonly

name	code-review-security
description	Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.
license	CC-BY-4.0

Security Code Review

Review code for security vulnerabilities by following the full procedure in plays/code-review-security.md.

Steps

Scope & Context — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local).
Systematic Review by Vulnerability Class (priority order):
- Injection (A03) — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection
- Authentication & Session (A07) — Hardcoded credentials, missing auth, weak sessions, JWT issues
- Authorization (A01) — Missing authz checks, IDOR, horizontal/vertical privilege escalation
- Cryptography (A02) — Weak algorithms, hardcoded keys, missing encryption, custom crypto
- Data Exposure (A01) — Sensitive data in errors/logs, credentials in code, debug mode
- Misconfiguration (A05) — Default credentials, permissive CORS, missing security headers
- Deserialization (A08) — Untrusted deserialization, missing integrity checks, CSRF gaps
Framework-Specific Checks — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go).
Diff-Specific Analysis (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls.
Produce Findings — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence.

Output

Scope summary, findings sorted by severity using templates/finding.md, positive observations (good security controls in place), and severity count table.

OWASP References

OWASP Top 10 (2021): A01-A10
OWASP ASVS v5.0
OWASP Code Review Guide
OWASP Cheat Sheet Series

related-skills.json

même dépôt

agent-security-audit.md

from "OWASP/secure-agent-playbook"

Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails. Use when reviewing CLAUDE.md files, MCP configs, agent orchestration code, or any AI agent setup.

2026-05-1778

agentic-ai-risk-assess.md

from "OWASP/secure-agent-playbook"

Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026. Use when reviewing autonomous AI agents, multi-agent systems, or agentic workflows for security risks including goal hijacking, tool misuse, privilege abuse, and rogue agent behavior.

2026-05-1778

llm-risk-assess.md

from "OWASP/secure-agent-playbook"

Comprehensive LLM security assessment against OWASP Top 10 for LLM Applications 2025. Use when reviewing LLM-integrated applications, RAG pipelines, chatbots, AI agents, or GenAI features. Covers prompt injection, data poisoning, supply chain, excessive agency, and more with real-world attack scenarios and testing methodologies.

2026-05-1778

mcp-server-review.md

from "OWASP/secure-agent-playbook"

Security review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.

2026-05-1778

prompt-injection-test.md

from "OWASP/secure-agent-playbook"

Test LLM-integrated applications against known prompt injection techniques, evasion methods, and attack intents using the Arcanum PI Taxonomy. Use when red-teaming AI apps, validating guardrails, or deepening LLM01 (Prompt Injection) assessments.

2026-05-1778

api-security-review.md

from "OWASP/secure-agent-playbook"

Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.

2026-05-1778

package.json

"author": "OWASP"

"repository": "OWASP/secure-agent-playbook"

Ouvrir le dépôt GitHub Voir les dépôts du créateur

$ install --global

$ download --local

Exécuter dans Manus

$ useful --forSOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques15-1212L4

name	code-review-security
description	Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.
license	CC-BY-4.0

Security Code Review

Review code for security vulnerabilities by following the full procedure in plays/code-review-security.md.

Steps

Scope & Context — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local).
Systematic Review by Vulnerability Class (priority order):
- Injection (A03) — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection
- Authentication & Session (A07) — Hardcoded credentials, missing auth, weak sessions, JWT issues
- Authorization (A01) — Missing authz checks, IDOR, horizontal/vertical privilege escalation
- Cryptography (A02) — Weak algorithms, hardcoded keys, missing encryption, custom crypto
- Data Exposure (A01) — Sensitive data in errors/logs, credentials in code, debug mode
- Misconfiguration (A05) — Default credentials, permissive CORS, missing security headers
- Deserialization (A08) — Untrusted deserialization, missing integrity checks, CSRF gaps
Framework-Specific Checks — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go).
Diff-Specific Analysis (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls.
Produce Findings — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence.

Output

Scope summary, findings sorted by severity using templates/finding.md, positive observations (good security controls in place), and severity count table.

OWASP References

OWASP Top 10 (2021): A01-A10
OWASP ASVS v5.0
OWASP Code Review Guide
OWASP Cheat Sheet Series

code-review-security

Security Code Review

Steps

Output

OWASP References

Plus depuis ce dépôt

Plus depuis ce dépôt

Security Code Review

Steps

Output

OWASP References