| name | verify-code |
| description | Security review of code for vulnerabilities. Use this skill whenever the user wants to check code for security issues, asks "is this code secure?", "review this for vulnerabilities", "any security issues here?", or pastes code and asks for feedback. Also trigger when the user has just finished coding a feature (especially auth, APIs, file handling, database queries, or anything that handles user input) and wants to verify it before shipping. Trigger on phrases like "review the code", "check for vulnerabilities", "audit this", "is this safe?", "security check on this", or after generating code with an AI and wanting to validate it. Works with any language: Python, JavaScript, TypeScript, Java, Go, Ruby, SQL, etc.
|
Perform a security review of the following code:
$ARGUMENTS
What to do
Review the code provided in the arguments above. If no code was provided, ask the user to paste the code or specify a file path to read. If a file path is mentioned, read the file first.
Step 1 — Detect Technologies
Identify language and frameworks from:
- File extension:
.py → Python, .ts/.tsx → TypeScript, .go → Go, .java → Java, .rb → Ruby, .php → PHP, .sql → SQL
- Import statements:
import django, require('express'), import React, use actix_web
- Syntax patterns:
def/class → Python, func → Go, public class → Java, fn → Rust
- Framework indicators:
@app.route → Flask, useState → React, @Controller → Spring
Step 2 — Check for Vulnerabilities by Language
Python:
- Command injection:
os.system(), subprocess with shell=True
- Unsafe deserialization:
pickle.loads() on untrusted data
- Code execution:
eval() / exec() with user-controlled input
- SQL injection via f-strings or
% formatting in queries
- Path traversal in
open() with user-supplied paths
JavaScript / TypeScript:
- XSS:
innerHTML, document.write(), dangerouslySetInnerHTML without sanitization
- Prototype pollution via
Object.assign / spread with user data
eval() or new Function() with dynamic content- Unvalidated
postMessage handlers
- Sensitive data in
localStorage or sessionStorage
React:
dangerouslySetInnerHTML without DOMPurify or equivalent- User input rendered directly in JSX without escaping
- Sensitive tokens/data stored in component state
Java:
Statement instead of PreparedStatement for SQLRuntime.exec() with user-controlled input- XXE vulnerabilities in XML parsers
- Unsafe deserialization (
ObjectInputStream)
Go:
- SQL injection in raw
database/sql queries
- Command injection in
exec.Command with user input
- Path traversal in file serving handlers
- Race conditions in concurrent code without proper locking
SQL:
- String concatenation in queries instead of parameterized queries
UPDATE/DELETE without WHERE clauseSELECT * returning sensitive columns unnecessarily- Overly permissive stored procedure privileges
Step 3 — Universal Security Checklist
Verify ALL of these, regardless of language:
Secrets & Credentials:
Injection:
Input Validation:
Authentication & Authorization:
Cryptography:
Error Handling & Logging:
Data Exposure:
Step 4 — Output
Produce this exact structure:
Security Code Review
File: [file path if known, or "provided code"]
Language/Frameworks: [detected list]
Risk Level: [LOW | MEDIUM | HIGH | CRITICAL]
Overall Assessment
[SECURE | NEEDS ATTENTION | INSECURE]
[1–2 sentences summarizing the security posture]
Findings
For each vulnerability found:
[SEVERITY: Critical/High/Medium/Low] — [Vulnerability Type]
Location: [function name or line number if identifiable]
Description: [what the vulnerability is and why it matters]
Vulnerable code:
[the problematic snippet]
Secure fix:
[the corrected code]
Checklist Results
- ✅ [Item that passes]
- ❌ [Item that fails — brief note]
- ⚠️ [Item that needs review — context-dependent]
Prioritized Recommendations
- [CRITICAL/HIGH] — [Action to take]
- ...
