Skip to content
cccskills
FreePublished on GitHub

security-review

Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.

OriginalShow the original description

Security-focused code review checklist for identifying vulnerabilities

mastra-ai/mastra

Run score Not tested

See how to install

Good for

  • Review SQL, shell commands, and HTML for unsafe input
  • Check authentication and access permissions
  • Find exposed credentials and sensitive log data
  • Organize security findings by severity

Files included (2)

  • SKILL.md2.0 KB
  • references/security-checklist.md1.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

  • SQL injection: Look for string concatenation in database queries
  • Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
  • XSS: Look for unsanitized user input rendered in HTML/templates
  • Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

  • Verify authentication checks on protected routes/endpoints
  • Ensure authorization checks match the required access level
  • Look for privilege escalation paths (e.g., user can modify other users' data)
  • Check that password/token comparison uses constant-time comparison

Secrets & Credentials

  • Hardcoded API keys, passwords, tokens, or connection strings
  • Secrets in configuration files that might be committed
  • Sensitive data in logs or error messages
  • Credentials passed via URL query parameters

Input Validation

  • Validate and sanitize all external input (user input, API responses, file contents)
  • Check for missing or weak input validation on API endpoints
  • Verify type coercion doesn't bypass validation
  • Look for overly permissive CORS or CSP configurations

Data Exposure

  • Sensitive data returned in API responses unnecessarily
  • PII or secrets in application logs
  • Information leakage in error messages (stack traces, internal paths)
  • Missing data encryption for sensitive fields

Severity Levels

  • 🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
  • 🟠 HIGH: Potential vulnerability that needs investigation
  • 🟡 MEDIUM: Security weakness or missing best practice
  • 🔵 LOW: Minor security improvement suggestion

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

agent-prompt-quality-bar

FreeSummary

Design and audit an agent's system prompt, the instructions that guide its work. Define a concrete outcome, starting input, available tools, completion checks, fallback behavior, and final report so the prompt describes a complete run.

  • Designing the core instructions for a new agent
  • Auditing a prompt before saving it
  • Defining behavior when tools or permissions are missing
mastra-ai/mastra29KUpdated Oct 23, 2026

builder-smoke-test

FreeSummary

Create a dedicated test project linked to the current worktree and check Agent Builder through APIs and browser interactions. It covers agent and skill management, permissions, defaults, and related features, with selectable test sections.

  • Validate an Agent Builder feature branch before review
  • Check role-based permissions and authentication
  • Test agent and skill management through APIs and the UI
mastra-ai/mastra29KUpdated Oct 23, 2026

code-standards

FreeSummary

Reviews pull requests for bugs, error handling, code quality, and style consistency. Organizes feedback into an overview, must-fix issues with file locations, improvement suggestions, and positive notes so reviewers can distinguish urgent problems from refinements.

  • Finding bugs that must be fixed before merging
  • Reviewing TypeScript types and asynchronous code
  • Checking naming, imports, and leftover debug statements
mastra-ai/mastra29KUpdated Oct 23, 2026

coding-agent

FreeSummary

Design instructions for agents that write, fix, review, or refactor code. Define behavior based on file access, select suitable tools, and set clear verification and completion rules for repository changes or copyable code output.

  • Designing an agent for repository bug fixes
  • Defining a pull request review agent
  • Creating a code generator without workspace access
mastra-ai/mastra29KUpdated Oct 23, 2026

configure-factory-rules

FreeSummary

Configure Factory board behavior and GitHub or Linear event handlers in deployment code. Adjust stage transitions, phase meanings, and tool-result handling, then check the changes with focused tests and versioned audit records.

  • Add approval requirements to board transitions
  • Change GitHub or Linear event handling
  • Define custom board phases and tool-result rules
mastra-ai/mastra29KUpdated Oct 23, 2026

content-writer-agent

FreeSummary

Design agents that draft blog posts, social posts, newsletters, and marketing copy. Define the audience, brand voice, length, and required output so each agent delivers a complete draft with a headline and supporting notes.

  • Build a blog writing agent with a consistent brand voice
  • Design an agent for LinkedIn product posts
  • Define delivery rules for newsletter drafts
mastra-ai/mastra29KUpdated Oct 23, 2026

See all skills by mastra-ai

Report a problem with this skill