skills.rest
open-mercato
open-mercatoOFFICIAL
Explore all skills by this author →
WebsiteGitHub

om-auto-sec-report-pr

Analyzes a single PR, spec, or branch diff for OWASP and non-obvious security vulnerabilities.

1.7k|382|Updated Sep 10, 2025
Search Tags:#owasp#security analysis#vulnerability detection#attack vectors#gitHub#Code review#Pull request
One-click install
npx skills add https://github.com/open-mercato/open-mercato --skill om-auto-sec-report-pr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: om-auto-sec-report-pr
Source: https://github.com/open-mercato/open-mercato/tree/main/.ai/skills/om-auto-sec-report-pr
Command: npx skills add https://github.com/open-mercato/open-mercato --skill om-auto-sec-report-pr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Conventional code review often misses subtle security flaws like TOCTOU races, cross-tenant cache leakage, JWT algorithm confusion, and SSRF redirect chains. This Skill performs a paranoid, OWASP-oriented security analysis of one unit of work — a pull request, a spec file, or a branch diff — and produces a structured markdown and HTML report with concrete follow-up scopes.

Core Features & Use Cases

  • Two-pass security sweep: Applies the Open Mercato code-review security baseline first, then walks a bundled deep-attack-vectors checklist covering tenant isolation, cryptography, SSRF, webhooks, money flows, rate limiting, and supply chain risks.
  • Apply-elsewhere and next-steps analysis: Greps for the same vulnerable pattern elsewhere in the codebase and emits 3-10 ordered follow-up scan targets with one marked as the recommended next run.
  • Standalone or sub-unit modes: Runs alone to produce a full report plus a docs-only PR, or emits a markdown fragment via --out-fragment for aggregation by the om-auto-sec-report driver.
  • Use Case: After a PR touching payment refund logic lands, run the Skill against that PR to surface double-charge idempotency gaps, find the same pattern in other modules, and queue a deeper audit of the sales package.

Quick Start

Run a paranoid security analysis on pull request 1456 and generate the markdown and HTML report under .ai/analysis/.

Frequently Asked Questions about om-auto-sec-report-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security analysis on a single pull request?▼

Invoke the Skill with the target `pr:{number}` or a bare PR number, for example `auto-sec-report-pr pr:1456`. It claims the PR, checks out an isolated worktree, runs the two-pass security sweep, and writes markdown and HTML reports under `.ai/analysis/`.

What security vulnerabilities does this analysis detect beyond OWASP Top 10?▼

It checks TOCTOU races on money-moving flows, cross-tenant cache and SSE leakage, JWT algorithm confusion, SSRF via redirect chains, open redirects, prototype pollution, ReDoS, webhook replay, idempotency gaps on payments, and supply chain risks from the bundled deep-attack-vectors checklist.

Can I analyze a spec file or branch instead of a pull request?▼

Yes. Pass `spec:{path}` for a markdown spec under `.ai/specs/` or `branch:{name}` to analyze a branch diff against the base branch. Spec targets also trigger spec-specific checks like ACL guards, PII field declarations, and tenant-scoped event ids.

Does the security report skill create or merge pull requests automatically?▼

In standalone mode it opens a docs-only PR against `develop` with labels `review`, `documentation`, `security`, and `skip-qa`, but it never merges. In sub-unit mode with `--out-fragment` it writes only a markdown fragment and creates no PR.

What are the limitations of automated paranoid security findings?▼

Classification is heuristic, so paranoid findings can be false positives that a human reviewer must confirm. Apply-elsewhere candidates are grep-based suggestions, not verified vulnerabilities, and spec-target findings reflect intent rather than implemented behavior.

Related Skills

Explore More Software Engineering Skills→
GenEducationGenEducation

ship

Prepare feature branches for release with tests, versioning, and pull requests.

Official
Advanced
dapperdiversdapperdivers
1

report-generator

Generate structured markdown penetration test reports from JSON security scan findings.

Community
Intermediate
IsKenKenYaIsKenKenYa

code-review

Review pull requests using a Sentry-aligned checklist for runtime, performance, security, and design risks.

Community
Basic
berksunduriberksunduri
23

golang-continuous-integration

Automate Go CI/CD pipelines with GitHub Actions for testing, linting, and releases.

Community
Advanced