source-code-security-patterns

name	Source Code Security Patterns
description	This skill should be used when analyzing discovered source code for security issues. Helps identify dangerous functions, hardcoded secrets, and vulnerable packages.
version	1.0.0

Source Code Security Patterns

Discovery Endpoints

Common backup/source locations to check:

• /download, /backup, /backup.zip
• /source.zip, /app.zip, /.git/
• *.bak, *.old files

Dangerous Patterns by Language

Python

Pattern	Risk	Notes
js2py with user input	Critical	Check CVE-2024-28397
yaml.load() no Loader	Critical	Use safe_load
subprocess shell=True	High	Command injection
render_template_string	High	SSTI
debug=True in Flask	Medium	Debugger access
Hardcoded secret_key	High	Session forgery

PHP

Pattern	Risk	Notes
system/passthru/shell calls	Critical	Command injection
include with variable	Critical	LFI/RFI
unserialize user data	Critical	Object injection

Node.js

Pattern	Risk	Notes
spawn/run with user input	High	Command injection
vm.runIn* functions	High	Sandbox escape
SQL string concatenation	High	SQL injection

Search for Secrets

# Passwords and keys
grep -rniE "(password|secret|token|api.?key)\s*[:=]" .

# Database URLs
grep -rniE "(mysql|postgres|mongo)://" .

# Private keys
grep -rnl "PRIVATE KEY" .

# Env files
find . -name ".env*"

Vulnerable Package Versions

Python (check requirements.txt)

• js2py <= 0.74: Sandbox escape CVE
• pyyaml < 5.4: Code execution
• flask < 2.0: Security fixes
• jinja2 < 2.11.3: Sandbox issues

Node.js (check package.json)

• lodash < 4.17.21: Prototype pollution
• serialize-javascript < 3.1.0: RCE

Quick Checklist

1. Check framework and version
2. Search for hardcoded secrets
3. Review package versions for CVEs
4. Find dangerous function calls
5. Look for debug mode enabled
6. Check for SQL string building
7. Find serialization with user input
8. Check template injection points