Verified:GitHub

dev-security

Identify security risks in application code and document exploit paths with evidence.

Updated Apr 27, 2026

Search Tags:#authorization #authentication #input-validation #devsecops #security-review #secret-management #code-security

Ready to run

npx skills add https://github.com/Conradmaker/copilot-cockpit --skill dev-security-conradmaker

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dev-security
Source: https://github.com/Conradmaker/copilot-cockpit/tree/main/.github/skills/dev-security
Command: npx skills add https://github.com/Conradmaker/copilot-cockpit --skill dev-security-conradmaker

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a streamlined framework for developers to quickly identify security risks in application code, document exploitability with concrete evidence, and guide safe remediation to reduce release risk.

Core Features & Use Cases

Attack surface mapping: identify inputs, data flows, and privilege boundaries across frontend and backend code.
AuthN/AuthZ & input validation review: verify proper authentication/authorization checks, secure handling of user input, and secrets management.
Evidence-backed findings & fixes: deliver actionable mitigations with concrete steps and references for remediation.

Quick Start

Review the target codebase for authentication, authorization, input validation, secrets, and data flow, then provide a concise security assessment with actionable mitigations.

Frequently Asked Questions about dev-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security risks in application code?▼

To identify security risks in application code, map the attack surface, review authentication and authorization logic, validate input handling, and trace data flows across frontend and backend boundaries to document exploit paths with concrete evidence.

How does attack surface mapping work for a codebase?▼

Attack surface mapping analyzes application code to identify external inputs, internal data flows, and privilege boundaries. It reveals where user-controlled data enters backend systems, helping track potential exploit paths and prioritize validation hardening.

What is the best way to review authentication and authorization logic?▼

The best way to review authentication and authorization logic is to verify proper AuthN/AuthZ checks across frontend and backend code, ensuring secure handling of user input and secrets while documenting exploitability and impact for safe remediation.

How do I document exploit paths with concrete evidence?▼

Document exploit paths by mapping data flows from untrusted inputs through privilege boundaries, capturing the exact exploitability, security impact, and recommended fixes like validation hardening and safe error exposure for developer-facing remediation.

Can I use this for frontend and backend code security reviews?▼

Yes, you can use this for developer-facing security reviews of both frontend and backend code. It evaluates authentication, authorization, input validation, secrets management, file I/O, and network interactions to deliver evidence-backed findings.

What are the limitations of automated DevSecOps code security analysis?▼

Automated DevSecOps code security analysis focuses on identifying surface risks and exploit paths but requires developer intervention to apply recommended fixes, implement proper secret handling, and enforce validation hardening across complex application logic.