skills.rest
KarenTenorio963
KarenTenorio963COMMUNITY
Explore all skills by this author →
GitHub

qa-security

Reviews code for exposed secrets, weak input validation, and risky exception handling.

Updated Aug 28, 2026
Search Tags:#input validation#qa#security review#code audit#secret detection#exception handling#gitignore
One-click install
npx skills add https://github.com/KarenTenorio963/curso-mcp-karentenorio --skill qa-security-karentenorio963
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: qa-security
Source: https://github.com/KarenTenorio963/curso-mcp-karentenorio/tree/main/entregas/s4/mi-proyecto-speckit/.agents/skills/qa-security
Command: npx skills add https://github.com/KarenTenorio963/curso-mcp-karentenorio --skill qa-security-karentenorio963

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It helps developers catch common security flaws in a project before they ship: hardcoded credentials, missing input validation, and dangerous exception patterns like bare except: blocks. ## Core Features & Use Cases - Secret Detection: Scans code for hardcoded keys and passwords, and verifies with git commands (git check-ignore, git ls-files) that .env files are truly ignored and not tracked in history. - Input Validation Review: Checks whether inputs are validated for type, format, length, and range. - Exception Handling Audit: Flags generic except: or except: pass patterns that silently swallow errors. - Use Case: Before committing a Python project, run this Skill to produce a hallazgos-seguridad.md report with a findings table and applied hygiene actions such as creating .env.example or fixing .gitignore. ## Quick Start Ask the AI to run the qa-security review on this project and save the findings report to hallazgos-seguridad.md.

Frequently Asked Questions about qa-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my code for hardcoded secrets and API keys?▼

Run a security review that scans source files for literal keys and passwords, then verifies with git check-ignore and git ls-files whether .env files are actually ignored or already tracked in git history.

How to verify a .env file is really ignored by git?▼

Run git check-ignore -q .env and confirm the exit code is 0, since reading .gitignore as text is unreliable. Also run git ls-files --error-unmatch .env to detect whether the file is already tracked in history.

What exception handling patterns are risky in Python?▼

Bare except: clauses and except: pass blocks are risky because they silently swallow all errors, hiding failures and making debugging impossible. Catch specific exception types instead.

Does this security review fix vulnerable code automatically?▼

No, it only diagnoses issues in business code and reports suggested corrections. The only automatic actions are hygiene fixes: creating .env.example and ensuring .env is properly ignored in .gitignore.

What should I do if a secret is already committed to git history?▼

Treat it as a critical finding: the secret may be exposed in the repository history. Rotate the credential immediately, move it to an environment variable read with os.environ.get, and consider history rewriting tools.

Related Skills

Explore More Software Engineering Skills→
chris-prenerchris-prener

readme

Audits and updates README.md to match the current codebase state.

Community
Advanced
microclawmicroclaw
731

code-review

Review code and diffs for correctness bugs, security issues, and simplifications.

Official
Basic
amanning3390amanning3390
13

security-auditor

Scan codebases for vulnerabilities, secret leaks, and misconfigurations.

Community
Advanced
harnessharness
80

configure-secret-scan

Automate secret scanning integration into existing Harness pipelines via MCP.

Official
Advanced