원클릭으로 Manus에서 모든 스킬 실행

시작하기

secure-code-review

스타42

포크13

업데이트2026년 1월 26일 21:35

Repeatable process for an application security code review that produces prioritized findings and fix guidance.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

Robotti-io

Robotti-io/copilot-security-instructions

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Secure Code Review

When to use

Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.

Inputs to collect (if available)

What component(s) are in scope (API, UI, worker, infra scripts)
Data sensitivity (PII, auth/session, payments)
Deployment assumptions (internet-facing, internal, multi-tenant)
Any known incidents, CVEs, or audit requirements

Step-by-step process

Map entry points & trust boundaries
- Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
- Identify where untrusted input crosses into privileged actions or sensitive sinks.
Scan for high-risk classes
- Injection: SQL/NoSQL/LDAP/OS/template
- Authn/authz: missing checks, insecure defaults, confused deputy
- Deserialization & file handling: unsafe loads, path traversal, upload
- Crypto: homegrown crypto, weak randomness, token validation mistakes
- Logging: secrets/PII exposure, overly verbose errors
- SSRF: URL fetchers, webhook validation gaps
Deep-dive the highest impact areas
- Trace data flow from input → validation → authorization → sink.
- Look for missing allow-lists, type confusion, and implicit conversions.
Write findings in a consistent format
- Title, severity, confidence
- Where (file/function)
- Risk + prerequisites
- Repro steps
- Recommendation + verification steps
Close with a remediation plan
- Quick wins (hours), medium fixes (days), structural guardrails (weeks).

Output template

Summary

Scope reviewed:
Top issues:
Overall risk: Low / Medium / High / Critical

Findings (repeat)

Title
Severity / Confidence
Where
Risk
Repro
Recommendation
Verification

Repo integration (optional)

If this repo includes prompt files under /prompts, the following are commonly relevant:

secure-code-review.prompt.md
scan-for-insecure-apis.prompt.md
validate-input-handling.prompt.md
review-auth-flows.prompt.md

이 저장소의 다른 Skills

같은 저장소

access-control-review

Robotti-io/copilot-security-instructions

Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.

2026-04-1842

dependency-cve-triage

Robotti-io/copilot-security-instructions

Triage a dependency CVE using local repo evidence and remediation guidance.

2026-04-1842

threat-model

Robotti-io/copilot-security-instructions

Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.

2026-04-1842

access-control-review

Robotti-io/copilot-security-instructions

Analyze repository-grounded identity, access control, and authorization design with evidence-first reporting and script-validated Mermaid diagrams.

2026-04-1842

threat-model

Robotti-io/copilot-security-instructions

Threat model a system, feature, service, or PR using Shostack's 4Q workflow, evidence-first analysis, risk scoring, and CLI-friendly Mermaid helper scripts.

2026-04-1542

genai-acceptance-review

Robotti-io/copilot-security-instructions

Review workflow for AI/LLM output usage to prevent over-trust, injection, and unsafe automation.

2026-01-2642

Secure Code Review

When to use

Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.

Inputs to collect (if available)

What component(s) are in scope (API, UI, worker, infra scripts)

Data sensitivity (PII, auth/session, payments)

Deployment assumptions (internet-facing, internal, multi-tenant)

Any known incidents, CVEs, or audit requirements

Step-by-step process

Map entry points & trust boundaries

Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
Identify where untrusted input crosses into privileged actions or sensitive sinks.

Scan for high-risk classes

Injection: SQL/NoSQL/LDAP/OS/template
Authn/authz: missing checks, insecure defaults, confused deputy
Deserialization & file handling: unsafe loads, path traversal, upload
Crypto: homegrown crypto, weak randomness, token validation mistakes
Logging: secrets/PII exposure, overly verbose errors
SSRF: URL fetchers, webhook validation gaps

Deep-dive the highest impact areas

Trace data flow from input → validation → authorization → sink.
Look for missing allow-lists, type confusion, and implicit conversions.

Write findings in a consistent format

Title, severity, confidence
Where (file/function)
Risk + prerequisites
Repro steps
Recommendation + verification steps

Close with a remediation plan

Quick wins (hours), medium fixes (days), structural guardrails (weeks).

Output template

Summary

Scope reviewed:

Top issues:

Overall risk: Low / Medium / High / Critical

Findings (repeat)

Title

Severity / Confidence

Where

Risk

Repro

Recommendation

Verification

Repo integration (optional)

If this repo includes prompt files under /prompts, the following are commonly relevant:

secure-code-review.prompt.md

scan-for-insecure-apis.prompt.md

validate-input-handling.prompt.md

review-auth-flows.prompt.md

name	secure-code-review
description	Repeatable process for an application security code review that produces prioritized findings and fix guidance.