本文へ移動
cccskills
無料GitHub で公開

security-review

Security-focused code review checklist for identifying vulnerabilities

mastra-ai/mastra
インストール方法を見る

含まれるファイル（2）

  • SKILL.md2.0 KB
  • references/security-checklist.md1.1 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

  • SQL injection: Look for string concatenation in database queries
  • Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
  • XSS: Look for unsanitized user input rendered in HTML/templates
  • Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

  • Verify authentication checks on protected routes/endpoints
  • Ensure authorization checks match the required access level
  • Look for privilege escalation paths (e.g., user can modify other users' data)
  • Check that password/token comparison uses constant-time comparison

Secrets & Credentials

  • Hardcoded API keys, passwords, tokens, or connection strings
  • Secrets in configuration files that might be committed
  • Sensitive data in logs or error messages
  • Credentials passed via URL query parameters

Input Validation

  • Validate and sanitize all external input (user input, API responses, file contents)
  • Check for missing or weak input validation on API endpoints
  • Verify type coercion doesn't bypass validation
  • Look for overly permissive CORS or CSP configurations

Data Exposure

  • Sensitive data returned in API responses unnecessarily
  • PII or secrets in application logs
  • Information leakage in error messages (stack traces, internal paths)
  • Missing data encryption for sensitive fields

Severity Levels

  • 🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
  • 🟠 HIGH: Potential vulnerability that needs investigation
  • 🟡 MEDIUM: Security weakness or missing best practice
  • 🔵 LOW: Minor security improvement suggestion

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

agent-prompt-quality-bar

無料

Universal quality bar and final audit rubric for any agent system prompt. Activate this whenever you are unsure which archetype skill applies, or as a final review pass before writing the system prompt. It defines the required run contract, completion criteria, fallback paths, response format, and anti-patterns every produced agent prompt must satisfy.

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

builder-smoke-test

無料

Smoke test the Agent Builder feature branch end-to-end against a hermetic project scaffolded by the skill (linked to the current worktree). Covers workspace reconciliation, stored agents/skills CRUD, ownership, visibility, stars, registry/library Copy flow, picker allowlists, model policy, RBAC role gating, role impersonation UI, builder defaults, infrastructure diagnostics, channels, and Studio + Agent Builder UI. Trigger when validating the agent-builder feature branch, PRs that touch packages/server, packages/playground, packages/playground-ui agent-builder routes, or builder EE code paths.

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

code-standards

無料

Code quality standards and style guide for reviewing pull requests

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

coding-agent

無料

Authoring playbook for building agents that write, edit, review, or refactor code. Use this when the user asks for an agent that writes scripts, generates code, reviews pull requests, refactors a codebase, fixes bugs, implements features, writes tests, or works with programming languages such as Python, TypeScript, JavaScript, Go, Rust, SQL, or shell.

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

configure-factory-rules

無料

Configure board-owned lifecycle, policy, phase-semantics, and tool-result rules, plus integration event rules

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

content-writer-agent

無料

Authoring playbook for building agents that draft written content — blog posts, marketing copy, social media posts, newsletters, product descriptions, landing pages, or ad copy. Use this when the user wants an agent that writes, drafts, or rewrites text for publication or marketing.

日本語の概要は準備中です。原文の説明を表示しています。

mastra-ai/mastra2.9万2026年10月13日 更新

mastra-ai のスキルをすべて見る

このスキルの問題を報告する