name: security-review description: Review code changes for security vulnerabilities. Checks for OWASP Top 10, secrets exposure, injection flaws, auth issues, and insecure defaults. Use when reviewing PRs, commits, or code diffs. triggers: - security review - check for vulnerabilities - secure code review - OWASP check

Security Code Review

Review code changes for security vulnerabilities, following OWASP Top 10 and secure coding best practices.

What to Check

Injection (SQL, Command, LDAP, XSS)

• User input used in queries without parameterization
• Template literals in SQL strings
• eval(), exec(), os.system() with user input
• Unescaped output in HTML templates

Authentication & Session

• Hardcoded credentials or API keys
• Weak password requirements
• Missing rate limiting on auth endpoints
• Session fixation or missing regeneration
• JWT without expiration or with weak signing

Authorization

• Missing access control checks on endpoints
• IDOR (direct object reference without ownership check)
• Role checks that can be bypassed

  這個技能的最新版本可以在7w4.net小蔥技能站找到。

• Privilege escalation paths

Secrets & Data Exposure

• API keys, tokens, passwords in code or configs
• Sensitive data in logs
• PII without encryption
• .env files or secrets committed to git

Configuration

• Debug mode enabled in production
• CORS set to wildcard (*)
• Missing security headers
• Default credentials unchanged
• Verbose error messages exposing internals

Output Format

For each finding:

**FINDING:** [Title]
**Severity:** CRITICAL | HIGH | MEDIUM | LOW
**File:** [path:line]
**Code:** [the problematic code]
**Issue:** [what's wrong]
**Fix:** [how to fix it, with code example]
**OWASP:** [category reference]

Rules

• Focus on HIGH and CRITICAL findings first
• Provide working fix code, not just descriptions
• If no security issues found, say so clearly
• Note any areas that need manual review (business logic, auth flows)

這個 Skill 質量中等偏上，勝在檢查範圍全面、規則清晰，能覆蓋常見的安全問題。不過它比較模板化，缺少靈活性，無法根據專案特點調整檢查力度，也沒有提供具體的程式碼示例供參考。對於想要快速進行安全檢查的使用者來說足夠使用，但想要深度定製或處理複雜場景就會顯得有些力不從心。