본문으로 건너뛰기
cccskills
무료GitHub에 공개

secure-code-review

Reviews code for common security flaws such as injection, broken authentication, unsafe deserialization, hardcoded secrets, path traversal and weak cryptography, and reports findings with severity and fixes. Use when the user asks for a security review, a pre-release audit or a check of code that handles user input, files or credentials.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit스타 48(GitHub 48 + cccskills 0)

실행 점수 미검증

설치 방법 보기

포함된 파일(1)

  • SKILL.md2.5 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Secure code review

When to use

  • Code parses user input, builds queries or commands, handles uploads or sessions.
  • Before a release, or when code from an unknown source is about to be merged.
  • The user asks "is this safe?" about a function or a service.

What to look for

  1. Injection. User input concatenated into SQL, shell commands, templates, LDAP or file paths.
  2. Authentication and sessions. Missing checks on endpoints, weak password storage, tokens in URLs, predictable ids.
  3. Authorization. Object access that trusts an id from the client without an ownership check.
  4. Secrets. Keys, tokens and passwords in code, config files, logs or error messages.
  5. Unsafe deserialization. pickle, yaml.load without a safe loader, Java object streams, eval on data.
  6. Path traversal and uploads. User controlled file names, missing type and size limits, files saved under the web root.
  7. Cryptography. Home made schemes, MD5 or SHA-1 for passwords, fixed IVs, random used for tokens.
  8. Network. Disabled TLS verification, permissive CORS, server side requests to user supplied URLs.
  9. Dependencies. Pinned versions with known advisories, install scripts that fetch code at run time.
  10. Error handling. Stack traces returned to clients, verbose logs with personal data.

Report format

For every finding give: severity (critical, high, medium, low), the file and line, one sentence on how it can be abused, and a corrected snippet. Order by severity. Finish with what was not reviewed.

Rules

  • Only report issues you can point to in the code. Mark guesses as "possible" and say what would confirm them.
  • Do not run or test against systems the user does not own.
  • Do not paste real secrets into the report. Show the first and last two characters at most.
  • Prefer the framework's built-in protection over custom code in fixes.

Errors

If only a snippet is available, state which parts of the application (auth, config, deployment) were out of view.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

api-endpoint-tester

무료

Runs a list of HTTP checks against a base URL from a JSON file and reports status codes, response time and body assertions. Use when the user asks whether an API is up, wants a smoke test after a deploy, or needs to verify that endpoints return what the docs promise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

changelog-generator

무료

Turns git log output into a grouped markdown changelog using conventional commit prefixes such as feat, fix and docs. Use when the user prepares a release, asks for release notes, or wants a summary of what changed between two tags.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

commit-message-writer

무료

Writes clear git commit messages in the conventional commits style from a diff or a description of the change. Use when the user asks for a commit message, wants to tidy up a message before pushing, or has staged changes and no wording yet.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

csv-profiler

무료

Profiles a CSV file column by column, reporting inferred type, missing values, unique counts and min, max and mean for numeric columns. Use when the user hands over a CSV and asks what is in it, whether the data is clean, or what to check before analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

dockerfile-linter

무료

Checks a Dockerfile for common problems such as unpinned base images, running as root, ADD instead of COPY, secrets in ENV or ARG and apt-get without cleanup. Use when the user asks to review, harden or slim down a Dockerfile.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

env-file-auditor

무료

Compares a .env file with its .env.example template and reports missing keys, undocumented extra keys, empty values and example files that contain real looking secrets. Use when the user asks why an app fails on startup with missing configuration, or wants to check environment files before committing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Lethe044/agentskill-kit482026년 10월 26일 업데이트

Lethe044의 스킬 모두 보기

이 스킬의 문제 신고