agentsclimarketplace
Sign in

Secure coding review

Skill minagayid/Agents/skills/library/secure-coding-review

Review code for security vulnerabilities (injection, authz, secrets, crypto, deserialization). Use when the user asks for a security review, to find vulnerabilities, or to harden code.From its SKILL.md

Install
npx -y skills add minagayid/Agents --skill secure-coding-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.8 KB, as published. Nobody here has run it

Secure Coding Review

Find and prioritize security vulnerabilities in a change or codebase. Map findings to the OWASP Top 10 where relevant.

What to check

  • Injection — SQL/NoSQL/OS-command/LDAP built from unsanitized input. Require parameterized queries / safe APIs, never string concatenation.
  • AuthN/AuthZ — every sensitive endpoint checks identity and permission; no missing object-level authorization (IDOR); no privilege escalation paths.
  • Secrets — no hard-coded keys/tokens/passwords; secrets from env/secret manager; not logged.
  • Input validation & output encoding — validate on the server; encode output for its sink (HTML/JS/SQL/shell).
  • XSS/CSRF — output escaping; anti-CSRF tokens on state-changing requests.
  • Crypto — modern algorithms, no MD5/SHA1 for passwords (use bcrypt/argon2), no hand-rolled crypto, random from a CSPRNG.
  • Deserialization / SSRF / path traversal — untrusted data never drives file paths, URLs, or object graphs.
  • Dependencies — known-vulnerable versions; run an SCA tool.
  • Errors & logging — no stack traces/secrets leaked to users; security events logged.

Report format

For each finding: severity (Critical/High/Medium/Low), file:line, the vulnerability class, a concrete exploit scenario, and the fix. Lead with the most severe.

Guidelines

  • Prefer proof over suspicion — show the tainted data path from source to sink.
  • Recommend the framework's safe primitive rather than a bespoke fix.
  • Note defense-in-depth, but don't drown criticals in style nits.

Keep looking

Skills are one crate of 627,559. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.