agentsclimarketplace
Sign in

Reviewing security

Skill bostonaholic/team/skills/reviewing-security

Security review methodology — attack-surface identification, OWASP Top 10 checks, additional vulnerability checks, and the CRITICAL/HIGH/MEDIUM/LOW severity classification ladder. Load when reviewing a diff for security vulnerabilities, auditing code for injection/XSS/secrets, or classifying a security finding's severity.From its SKILL.md

Install
npx -y skills add bostonaholic/team --skill reviewing-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 11 stars11 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.3 KB, as published. Nobody here has run it

Reviewing Security

Security Reviewer Process

  1. Read the diff. Run git diff HEAD~1 (or the applicable range) to see what changed.

  2. Identify the attack surface. Determine what the changed code touches: user input, authentication, authorization, data storage, external services, file system, command execution, serialization, or network communication.

  3. Apply OWASP Top 10 checks to every changed file:

    • Injection — SQL, NoSQL, OS command, LDAP. Is user input interpolated into queries or commands without parameterization?
    • Broken Authentication — Weak password handling, missing rate limiting, session fixation, credential exposure in logs.
    • Sensitive Data Exposure — Secrets in code, PII in logs, missing encryption, overly broad API responses.
    • XSS — User input rendered without escaping in HTML, JavaScript, or template contexts.
    • CSRF — State-changing operations without token validation.
    • Insecure Deserialization — Untrusted data passed to deserializers without validation.
    • Missing Access Control — Authorization checks absent or bypassable, IDOR vulnerabilities, privilege escalation paths.
    • Security Misconfiguration — Debug mode in production, overly permissive CORS, missing security headers, default credentials.

  4. Check for more vulnerabilities:

    • Hardcoded secrets — API keys, passwords, tokens, connection strings in source code or configuration committed to version control.
    • Command injection — User input passed to shell execution, exec, spawn, or eval without sanitization.
    • Path traversal — User-controlled input used in file paths without validation (e.g., ../../../etc/passwd).
    • Unsafe regex — Regular expressions vulnerable to ReDoS (catastrophic backtracking with user-controlled input).
    • Missing input validation — Data crossing system boundaries (HTTP requests, file uploads, environment variables) without schema validation or sanitization.

  5. Search beyond the diff. If the diff introduces a pattern that could be vulnerable, grep the broader codebase for similar patterns.

Security Severity Classification

CRITICAL — Hard Gate

The code MUST NOT ship with these findings. Examples:

  • Hardcoded secrets or credentials
  • SQL/command injection with user-controlled input
  • Authentication bypass
  • Missing authorization on sensitive endpoints

HIGH — Hard Gate

The code MUST NOT ship with these findings. Examples:

  • XSS in user-facing output
  • CSRF on state-changing endpoints
  • Sensitive data in logs

MEDIUM

Moderate risk, should be addressed soon. Examples:

  • Overly permissive CORS configuration
  • Missing rate limiting on auth endpoints
  • Weak cryptographic choices

LOW

Minor risk or defense-in-depth improvement. Examples:

  • Missing security headers on non-sensitive endpoints
  • Informational leakage in error messages

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most threat modeling skills give

Counted across 325 of the 341 authors here whose files we hold, read 2026-09-06

  • Use parameterized queries for all database accessin 58 of 325, across 34 files
  • Validate all user input with schemasin 52 of 325, across 29 files
  • Store tokens in httpOnly cookiesin 50 of 325, across 27 files
  • Store secrets in environment variablesin 50 of 325, across 27 files
  • Sanitize user-provided HTML before renderingin 49 of 325, across 26 files
  • Apply rate limiting to all API endpointsin 48 of 325, across 25 files
  • Verify authorization before sensitive operationsin 47 of 325, across 24 files
  • Require CSRF tokens on state-changing operationsin 46 of 325, across 23 files
  • Return generic error messages to usersin 40 of 325, across 22 files
  • Restrict file uploads by size, type, and extensionin 38 of 325, across 20 files
  • Run npm audit and fix vulnerabilitiesin 28 of 325, across 16 files
  • Redact sensitive data from logsin 25 of 325, across 11 files

Said here and by no other author read

  • Identify the attack surface of the changed code
  • Check for hardcoded secrets, injection, path traversal, unsafe regex
  • Grep the broader codebase for similar vulnerable patterns

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.

Keep looking

Skills are one crate of 626,194. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.