본문으로 건너뛰기
cccskills
무료GitHub에 공개

security-review

Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

Security-focused code review checklist for identifying vulnerabilities

mastra-ai/mastra
설치 방법 보기

이럴 때 유용합니다

  • Review SQL, shell commands, and HTML for unsafe input
  • Check authentication and access permissions
  • Find exposed credentials and sensitive log data
  • Organize security findings by severity

포함된 파일(2)

  • SKILL.md2.0 KB
  • references/security-checklist.md1.1 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

  • SQL injection: Look for string concatenation in database queries
  • Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
  • XSS: Look for unsanitized user input rendered in HTML/templates
  • Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

  • Verify authentication checks on protected routes/endpoints
  • Ensure authorization checks match the required access level
  • Look for privilege escalation paths (e.g., user can modify other users' data)
  • Check that password/token comparison uses constant-time comparison

Secrets & Credentials

  • Hardcoded API keys, passwords, tokens, or connection strings
  • Secrets in configuration files that might be committed
  • Sensitive data in logs or error messages
  • Credentials passed via URL query parameters

Input Validation

  • Validate and sanitize all external input (user input, API responses, file contents)
  • Check for missing or weak input validation on API endpoints
  • Verify type coercion doesn't bypass validation
  • Look for overly permissive CORS or CSP configurations

Data Exposure

  • Sensitive data returned in API responses unnecessarily
  • PII or secrets in application logs
  • Information leakage in error messages (stack traces, internal paths)
  • Missing data encryption for sensitive fields

Severity Levels

  • 🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
  • 🟠 HIGH: Potential vulnerability that needs investigation
  • 🟡 MEDIUM: Security weakness or missing best practice
  • 🔵 LOW: Minor security improvement suggestion

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

agent-prompt-quality-bar

무료

Design and audit an agent's system prompt, the instructions that guide its work. Define a concrete outcome, starting input, available tools, completion checks, fallback behavior, and final report so the prompt describes a complete run.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Designing the core instructions for a new agent
  • Auditing a prompt before saving it
  • Defining behavior when tools or permissions are missing
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

builder-smoke-test

무료

Create a dedicated test project linked to the current worktree and check Agent Builder through APIs and browser interactions. It covers agent and skill management, permissions, defaults, and related features, with selectable test sections.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Validate an Agent Builder feature branch before review
  • Check role-based permissions and authentication
  • Test agent and skill management through APIs and the UI
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

code-standards

무료

Reviews pull requests for bugs, error handling, code quality, and style consistency. Organizes feedback into an overview, must-fix issues with file locations, improvement suggestions, and positive notes so reviewers can distinguish urgent problems from refinements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Finding bugs that must be fixed before merging
  • Reviewing TypeScript types and asynchronous code
  • Checking naming, imports, and leftover debug statements
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

coding-agent

무료

Design instructions for agents that write, fix, review, or refactor code. Define behavior based on file access, select suitable tools, and set clear verification and completion rules for repository changes or copyable code output.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Designing an agent for repository bug fixes
  • Defining a pull request review agent
  • Creating a code generator without workspace access
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

configure-factory-rules

무료

Configure Factory board behavior and GitHub or Linear event handlers in deployment code. Adjust stage transitions, phase meanings, and tool-result handling, then check the changes with focused tests and versioned audit records.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Add approval requirements to board transitions
  • Change GitHub or Linear event handling
  • Define custom board phases and tool-result rules
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

content-writer-agent

무료

Design agents that draft blog posts, social posts, newsletters, and marketing copy. Define the audience, brand voice, length, and required output so each agent delivers a complete draft with a headline and supporting notes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Build a blog writing agent with a consistent brand voice
  • Design an agent for LinkedIn product posts
  • Define delivery rules for newsletter drafts
mastra-ai/mastra2.9만2026년 10월 22일 업데이트

mastra-ai의 스킬 모두 보기

이 스킬의 문제 신고