Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

owasp-review

Estrelas2

Forks0

Atualizado12 de julho de 2026 às 12:09

Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

YaoYinYing

YaoYinYing/REvoDesign

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".

Mais deste repositório

mesmo repositório

adversarial-verify

YaoYinYing/REvoDesign

Review a diff against the goal spec assuming the code is BROKEN. The reviewer that lives in the maker's head always agrees with itself — this pulls review into a hostile, separate pass. Invoke after every code change before marking work done.

2026-07-122

authz-check

YaoYinYing/REvoDesign

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

2026-07-122

bisect-regression

YaoYinYing/REvoDesign

Find the exact commit that introduced a bug. Use when something worked before and broke, and you don't know which change did it.

2026-07-122

changelog-from-diff

YaoYinYing/REvoDesign

Turn a set of commits or a diff into a clean, user-facing changelog entry. Use before a release or PR description.

2026-07-122

clean-commits

YaoYinYing/REvoDesign

Turn messy WIP into clean, atomic commits with messages that explain why. Use before opening a PR.

2026-07-122

context-budget

YaoYinYing/REvoDesign

Keep the agent's context lean so accuracy doesn't collapse. Use on long sessions, big files, or when the agent starts hallucinating.

2026-07-122

name	owasp-review
description	Security-review a diff against the OWASP Top 10. Use before merging anything that touches auth, input handling, queries, or external calls.
when_to_use	new endpoint, auth/session change, user input, raw query, file upload, deserialization

OWASP Review

Check the diff for each, with the exact line:

Injection — any string-built SQL/shell/HTML. Demand parameterized queries / escaping.
Broken access control — does it verify the user OWNS the resource, not just that they're logged in?
Auth — secrets in code? tokens without expiry? password compare not constant-time?
SSRF — user-controlled URL fetched server-side without an allowlist.
Sensitive data — PII/secrets logged, returned in errors, or sent unencrypted.
Deserialization — untrusted input into pickle/yaml.load/eval.
Dependency — a new package with known CVEs or no maintenance. Output: a list of {line, risk, fix}. If clean, say so explicitly. Never assume input is safe because "it comes from our frontend".