skills.rest
kehwar
kehwarCOMMUNITY
Explore all skills by this author →
GitHub

api-reviewer

Scan Frappe codebases for @frappe.whitelist() endpoints and generate YAML security reviews.

1|Updated Jan 16, 2025
Search Tags:#security#code-analysis#frappe#api-review#frappe.whitelist#permission-checks
One-click install
npx skills add https://github.com/kehwar/frappe_tweaks --skill api-reviewer-kehwar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-reviewer
Source: https://github.com/kehwar/frappe_tweaks/tree/main/.github/skills/api-reviewer
Command: npx skills add https://github.com/kehwar/frappe_tweaks --skill api-reviewer-kehwar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yaml, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Identifies and fixes security vulnerabilities in Frappe API endpoints that use the @frappe.whitelist() decorator.

Core Features & Use Cases

  • Scan and detect endpoints using @frappe.whitelist() across a codebase.
  • Flag missing role restrictions, permission checks, and unsafe queries to guide secure coding.
  • Generate and merge a structured YAML report detailing endpoints, security checks, and review status for documentation and audits.

Quick Start

Run the included scanner to detect endpoints and generate a security review YAML report.

Frequently Asked Questions about api-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Frappe API endpoints for security vulnerabilities?▼

To audit Frappe API endpoints for security, you can use automated scanning with AST-based detection to identify endpoints decorated with @frappe.whitelist() and generate a structured YAML security review report.

How do I check for missing permission checks on @frappe.whitelist endpoints?▼

Checking for missing permission checks on @frappe.whitelist endpoints involves automated scanning that flags missing role restrictions, frappe.only_for, frappe.has_permission, and unsafe query practices to guide secure coding.

What is the best way to document Frappe API security reviews across a codebase?▼

The best way to document Frappe API security reviews is to generate and merge a structured YAML report detailing endpoints, security checks, and review status for documentation and audits.

Can I use AST-based scanning to detect @frappe.whitelist() usage in my project?▼

Yes, you can use AST-based scanning to detect @frappe.whitelist() usage across your codebase, flag missing role restrictions, and enforce permission checks for endpoint exposure.

Does this API review tool require YAML dependencies?▼

Yes, this API review tool requires YAML dependencies to merge results into a YAML file with endpoint metadata for security documentation and audits.

Related Skills

Explore More Software Engineering Skills→
lpjhelderlpjhelder

forge-setup

Install and configure kronon-forge with Node.js and npm.

Community
Intermediate
SjdjdiejdrirhdkjejSjdjdiejdrirhdkjej

optimization-phase

Run post-implementation quality gates and generate reports before release.

Community
Advanced
julianobarbosajulianobarbosa
7

reviewing-code

Review code for quality, bugs, security issues, and best practices using Codex.

Community
Advanced
sparkfabriksparkfabrik
3

code-security-audit

Audit multi-stack web projects for vulnerabilities with Dockerized scanners.

Official
Advanced