What problem does it solve?
This Skill helps teams detect newly introduced application-security vulnerabilities that appear during fast iteration, such as secret leaks, unsafe webhook handling, SSRF, insecure file handling, XSS, unsafe redirects, and missing rate limits.
Core Features & Use Cases
- Secret exposure regression checks: Verifies whether secret-like environment variables are logged or accidentally reach client bundles.
- Webhook signature verification validation: Flags webhook handlers that process requests without verifying authenticity.
- SSRF and unsafe fetch validation: Detects fetch/HTTP calls that may use user-controlled URLs without allowlisting.
- Upload/download safety review: Looks for unsafe handling in upload/download paths, including traversal and missing constraints.
- Dangerous rendering detection: Finds risky rendering patterns like dangerouslySetInnerHTML and unsafe innerHTML usage tied to user content.
- Redirect and security header hygiene: Identifies open-redirect patterns and missing rel="noopener noreferrer" on target="_blank".
- Abuse-prone endpoint rate limiting checks: Flags new public endpoints that may need rate limiting.
Quick Start
Run a Git diff–scoped security regression scan and review the ranked HIGH/MEDIUM/LOW findings, applying only the allowed mechanical auto-fixes.
