Skip to main content ホーム クリエイター seaworld008 commonly-used-high-value-skills security-review
security-review Security code review for vulnerabilities. Use when asked to \"security review\", \"find vulnerabilities\", \"check for security issues\", \"audit security\", \"OWASP review\", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill security-reviewコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.
name security-review description Security code review for vulnerabilities. Use when asked to \"security review\", \"find vulnerabilities\", \"check for security issues\", \"audit security\", \"OWASP review\", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting. zh_description 用于安全、评审，支持安全扫描、审计、加固和风险治理。 version 1.0.0 author seaworld008 source github:getsentry/skills source_url https://skills.sh/getsentry/skills/security-review license Apache-2.0 tags ["review", "security"] created_at 2026-06-21 updated_at 2026-06-21 quality 5 complexity intermediate allowed-tools Read, Grep, Glob, Bash, Task
Security Review Skill
Identify exploitable security vulnerabilities in code. Report only HIGH CONFIDENCE findings—clear vulnerable patterns with attacker-controlled input.
Scope: Research vs. Reporting
CRITICAL DISTINCTION:
Report on : Only the specific file, diff, or code provided by the userResearch : The ENTIRE codebase to build confidence before reporting
Before flagging any issue, you MUST research the codebase to understand:
Where does this input actually come from? (Trace data flow)
Is there validation/sanitization elsewhere?
How is this configured? (Check settings, config files, middleware)
What framework protections exist?
Do NOT report issues based solely on pattern matching. Investigate first, then report only what you're confident is exploitable.
Confidence Levels
Level Criteria Action HIGH Vulnerable pattern + attacker-controlled input confirmed Report with severityMEDIUM Vulnerable pattern, input source unclear Note as "Needs verification"LOW Theoretical, best practice, defense-in-depth Do not report
Do Not Flag
General Rules
Test files (unless explicitly reviewing test security)
Dead code, commented code, documentation strings
Patterns using constants or server-controlled configuration
Code paths that require prior authentication to reach (note the auth requirement instead)
Server-Controlled Values (NOT Attacker-Controlled)
These are configured by operators, not controlled by attackers:
Source Example Why It's Safe Django settings settings.API_URL, settings.ALLOWED_HOSTSSet via config/env at deployment Environment variables os.environ.get('DATABASE_URL')
Config files config.yaml, app.config['KEY']Server-side files
Framework constants django.conf.settings.*Not user-modifiable
Hardcoded values BASE_URL = "https://api.internal"Compile-time constants
SSRF Example - NOT a vulnerability:
response = requests.get(f"{settings.SEER_AUTOFIX_URL} {path} " )
SSRF Example - IS a vulnerability:
response = requests.get(request.GET.get('url' ))
Framework-Mitigated Patterns Check language guides before flagging. Common false positives:
Pattern Why It's Usually Safe Django {{ variable }} Auto-escaped by default React {variable} Auto-escaped by default Vue {{ variable }} Auto-escaped by default User.objects.filter(id=input)ORM parameterizes queries cursor.execute("...%s", (input,))Parameterized query innerHTML = "<b>Loading...</b>"Constant string, no user input
Django: {{ var|safe }}, {% autoescape off %}, mark_safe(user_input)
React: dangerouslySetInnerHTML={{__html: userInput}}
Vue: v-html="userInput"
ORM: .raw(), .extra(), RawSQL() with string interpolation
Review Process
1. Detect Context What type of code am I reviewing?
Code Type Load These References API endpoints, routes authorization.md, authentication.md, injection.mdFrontend, templates xss.md, csrf.mdFile handling, uploads file-security.mdCrypto, secrets, tokens cryptography.md, data-protection.mdData serialization deserialization.mdExternal requests ssrf.mdBusiness workflows business-logic.mdGraphQL, REST design api-security.mdConfig, headers, CORS misconfiguration.mdCI/CD, dependencies supply-chain.mdError handling error-handling.mdAudit, logging logging.md
2. Load Language Guide Based on file extension or imports:
Indicators Guide .py, django, flask, fastapilanguages/python.md.js, .ts, express, react, vue, nextlanguages/javascript.md.go, go.modlanguages/go.md.rs, Cargo.tomllanguages/rust.md.java, spring, @Controllerlanguages/java.md
3. Load Infrastructure Guide (if applicable) File Type Guide Dockerfile, .dockerignoreinfrastructure/docker.mdK8s manifests, Helm charts infrastructure/kubernetes.md.tf, Terraforminfrastructure/terraform.mdGitHub Actions, .gitlab-ci.yml infrastructure/ci-cd.mdAWS/GCP/Azure configs, IAM infrastructure/cloud.md
4. Research Before Flagging For each potential issue, research the codebase to build confidence:
Where does this value actually come from? Trace the data flow.
Is it configured at deployment (settings, env vars) or from user input?
Is there validation, sanitization, or allowlisting elsewhere?
What framework protections apply?
Only report issues where you have HIGH confidence after understanding the broader context.
5. Verify Exploitability For each potential finding, confirm:
Is the input attacker-controlled?
Attacker-Controlled (Investigate) Server-Controlled (Usually Safe) request.GET, request.POST, request.argssettings.X, app.config['X']request.json, request.data, request.bodyos.environ.get('X')request.headers (most headers)Hardcoded constants request.cookies (unsigned)Internal service URLs from config URL path segments: /users/<id>/ Database content from admin/system File uploads (content and names) Signed session data Database content from other users Framework settings WebSocket messages
Does the framework mitigate this?
Check language guide for auto-escaping, parameterization
Check for middleware/decorators that sanitize
Is there validation upstream?
Input validation before this code
Sanitization libraries (DOMPurify, bleach, etc.)
6. Report HIGH Confidence Only Skip theoretical issues. Report only what you've confirmed is exploitable after research.
Severity Classification Severity Impact Examples Critical Direct exploit, severe impact, no auth required RCE, SQL injection to data, auth bypass, hardcoded secrets High Exploitable with conditions, significant impact Stored XSS, SSRF to metadata, IDOR to sensitive data Medium Specific conditions required, moderate impact Reflected XSS, CSRF on state-changing actions, path traversal Low Defense-in-depth, minimal direct impact Missing headers, verbose errors, weak algorithms in non-critical context
Quick Patterns Reference
Always Flag (Critical) eval(user_input) # Any language
exec(user_input) # Any language
pickle.loads(user_data) # Python
yaml.load(user_data) # Python (not safe_load)
unserialize($user_data) # PHP
deserialize(user_data) # Java ObjectInputStream
shell=True + user_input # Python subprocess
child_process.exec(user) # Node.js
Always Flag (High) innerHTML = userInput # DOM XSS
dangerouslySetInnerHTML={user} # React XSS
v-html="userInput" # Vue XSS
f"SELECT * FROM x WHERE {user}" # SQL injection
`SELECT * FROM x WHERE ${user}` # SQL injection
os.system(f"cmd {user_input}") # Command injection
Always Flag (Secrets) password = "hardcoded"
api_key = "sk-..."
AWS_SECRET_ACCESS_KEY = "..."
private_key = "-----BEGIN"
Check Context First (MUST Investigate Before Flagging) # SSRF - ONLY if URL is from user input, NOT from settings/config
requests.get(request.GET['url']) # FLAG: User-controlled URL
requests.get(settings.API_URL) # SAFE: Server-controlled config
requests.get(f"{settings.BASE}/{x}") # CHECK: Is 'x' user input?
# Path traversal - ONLY if path is from user input
open(request.GET['file']) # FLAG: User-controlled path
open(settings.LOG_PATH) # SAFE: Server-controlled config
open(f"{BASE_DIR}/{filename}") # CHECK: Is 'filename' user input?
# Open redirect - ONLY if URL is from user input
redirect(request.GET['next']) # FLAG: User-controlled redirect
redirect(settings.LOGIN_URL) # SAFE: Server-controlled config
# Weak crypto - ONLY if used for security purposes
hashlib.md5(file_content) # SAFE: File checksums, caching
hashlib.md5(password) # FLAG: Password hashing
random.random() # SAFE: Non-security uses (UI, sampling)
random.random() for token # FLAG: Security tokens need secrets module
Output Format ## Security Review: [File/Component Name]
### Summary
- **Findings** : X (Y Critical, Z High, ...)
- **Risk Level** : Critical/High/Medium/Low
- **Confidence** : High/Mixed
### Findings
#### [VULN-001] [Vulnerability Type] (Severity)
- **Location** : `file.py:123`
- **Confidence** : High
- **Issue** : [What the vulnerability is]
- **Impact** : [What an attacker could do]
- **Evidence** :
```python
[Vulnerable code snippet]
Needs Verification
[VERIFY-001] [Potential Issue]
Location : file.py:456Question : [What needs to be verified]
If no vulnerabilities found, state: "No high-confidence vulnerabilities identified."
---
## Reference Files
### Core Vulnerabilities (`references/`)
| File | Covers |
|------|--------|
| `injection.md` | SQL, NoSQL, OS command, LDAP, template injection |
| `xss.md` | Reflected, stored, DOM-based XSS |
| `authorization.md` | Authorization, IDOR, privilege escalation |
| `authentication.md` | Sessions, credentials, password storage |
| `cryptography.md` | Algorithms, key management, randomness |
| `deserialization.md` | Pickle, YAML, Java, PHP deserialization |
| `file-security.md` | Path traversal, uploads, XXE |
| `ssrf.md` | Server-side request forgery |
| `csrf.md` | Cross-site request forgery |
| `data-protection.md` | Secrets exposure, PII, logging |
| `api-security.md` | REST, GraphQL, mass assignment |
| `business-logic.md` | Race conditions, workflow bypass |
| `modern-threats.md` | Prototype pollution, LLM injection, WebSocket |
| `misconfiguration.md` | Headers, CORS, debug mode, defaults |
| `error-handling.md` | Fail-open, information disclosure |
| `supply-chain.md` | Dependencies, build security |
| `logging.md` | Audit failures, log injection |
### Language Guides (`languages/`)
- `python.md` - Django, Flask, FastAPI patterns
- `javascript.md` - Node, Express, React, Vue, Next.js
- `go.md` - Go-specific security patterns
- `rust.md` - Rust unsafe blocks, FFI security
- `java.md` - Spring, Java EE patterns
### Infrastructure (`infrastructure/`)
- `docker.md` - Container security
- `kubernetes.md` - K8s RBAC, secrets, policies
- `terraform.md` - IaC security
- `ci-cd.md` - Pipeline security
- `cloud.md` - AWS/GCP/Azure security
