Query review
Defensive AI security audit skill for Claude and Codex. Reviews codebases and web apps for OWASP Top 10, auth and authorization flaws, business logic bugs, tenant isolation gaps, insecure defaults, secret leaks, and ORM or N+1 query issues, then produces clear remediation guidance.
npx -y skills add MuhammedZohaib/patchman --skill query-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Review an authorized codebase for ORM misuse, N+1 query patterns, authorization-after-fetch bugs, raw SQL risks, cache key collisions, and missing tenant scopes. Use for data-access layers and security-adjacent performance pitfalls.
SKILL.md
0.7 KB, as published. Nobody here has run it
Query Review
Focus
- missing tenant scopes
- authorization after broad fetches
- raw SQL without parameter binding
- N+1 patterns that become availability or side-channel issues
- eager loads that overexpose sensitive associations
- cache keys missing tenant or role context
Heuristic
Treat data-access issues as security-relevant when they change scope, leak metadata, or undermine availability controls.