免费在 GitHub 公开

security-review

Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.

中文简介正在准备中。当前显示英语简介。

原文查看原文说明

Security-focused code review checklist for identifying vulnerabilities

mastra-ai/mastra

实测评分未实测

查看安装方法

适用场景

Review SQL, shell commands, and HTML for unsafe input
Check authentication and access permissions
Find exposed credentials and sensitive log data
Organize security findings by severity

包含的文件（2）

SKILL.md2.0 KB
references/security-checklist.md1.1 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

SQL injection: Look for string concatenation in database queries
Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
XSS: Look for unsanitized user input rendered in HTML/templates
Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

Verify authentication checks on protected routes/endpoints
Ensure authorization checks match the required access level
Look for privilege escalation paths (e.g., user can modify other users' data)
Check that password/token comparison uses constant-time comparison

Secrets & Credentials

Hardcoded API keys, passwords, tokens, or connection strings
Secrets in configuration files that might be committed
Sensitive data in logs or error messages
Credentials passed via URL query parameters

Input Validation

Validate and sanitize all external input (user input, API responses, file contents)
Check for missing or weak input validation on API endpoints
Verify type coercion doesn't bypass validation
Look for overly permissive CORS or CSP configurations

Data Exposure

Sensitive data returned in API responses unnecessarily
PII or secrets in application logs
Information leakage in error messages (stack traces, internal paths)
Missing data encryption for sensitive fields

Severity Levels

🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
🟠 HIGH: Potential vulnerability that needs investigation
🟡 MEDIUM: Security weakness or missing best practice
🔵 LOW: Minor security improvement suggestion

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

agent-prompt-quality-bar

免费

Design and audit an agent's system prompt, the instructions that guide its work. Define a concrete outcome, starting input, available tools, completion checks, fallback behavior, and final report so the prompt describes a complete run.

中文简介正在准备中。当前显示英语简介。

Designing the core instructions for a new agent
Auditing a prompt before saving it
Defining behavior when tools or permissions are missing