Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

mcp-security-review

Estrelas2

Forks0

Atualizado8 de julho de 2026 às 04:02

Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

tvnkhoa

tvnkhoa/mcp-local

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.

Mais deste repositório

mesmo repositório

key

tvnkhoa/mcp-local

"Browse Bitbucket Cloud repositories and pull requests, read PR diffs, and create pull requests via the {{DISPLAY_NAME}}. Triggers on: list repos/branches/PRs, view a pull request or its diff, open/create a PR. PR creation is gated and supports dryRun."

2026-07-082

db-parameterization-audit

tvnkhoa/mcp-local

Audit SQL construction to ensure parameterized execution, anti-concatenation posture, and read-only safety.

2026-07-082

db-query-budgeting

tvnkhoa/mcp-local

Control DB query budget with timeout, row limits, and concurrency caps to prevent abuse and resource exhaustion.

2026-07-082

mcp-contract-conformance

tvnkhoa/mcp-local

Validate MCP contract stability for tools/list, tools/call, schemas, and backward compatibility before merge or release.

2026-07-082

mcp-error-taxonomy

tvnkhoa/mcp-local

Standardize MCP errors into user-actionable vs developer/internal classes with stable codes and safe messages.

2026-07-082

mcp-host-integration-security

tvnkhoa/mcp-local

Harden MCP host/client integration with token hygiene, scope minimization, transport safeguards, and policy checks.

2026-07-082

name	mcp-security-review
description	Review MCP server changes for security guardrails: least privilege, read-only DB defaults, SQL safety checks, secrets handling, and safe logging. Use before merging DB-related MCP changes.

MCP Security Review

When to Use

Any DB-related MCP tool change.
Any change touching SQL validation or query execution.
Pre-merge review for MCP safety posture.

Review Checklist

Privilege
- Is behavior least-privilege by default?
- Are mutating operations explicitly requested and bounded?
SQL Guardrails
- Single-statement enforcement present?
- Dangerous tokens blocked for read-only paths?
- Query timeout and result limits enforced?
Input Safety
- Inputs validated via schema (zod)?
- Query args parameterized?
Secrets & Logging
- No hardcoded secrets/tokens/connection strings.
- Logs avoid sensitive payloads and full raw SQL where risky.
Error Surfaces
- Error messages actionable but not sensitive.
Docs & Operability
- README.md updated for tool inputs/limits/examples.

Output Format

Pass/fail summary.
List of findings with severity: high|medium|low.
Concrete remediation suggestions.