skills.rest
PostHog
PostHogOFFICIAL
Explore all skills by this author →
Website𝕏@PostHogGitHub

review-hog-perspective-contracts-security

Reviews pull request code for security vulnerabilities and API contract breaking changes.

713|118|Updated Aug 11, 2020
Search Tags:#API contracts#vulnerability detection#Security#Input Validation#schema alignment#Code review#Pull request
One-click install
npx skills add https://github.com/PostHog/posthog-foss --skill review-hog-perspective-contracts-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-hog-perspective-contracts-security
Source: https://github.com/PostHog/posthog-foss/tree/main/products/review_hog/skills/review-hog-perspective-contracts-security
Command: npx skills add https://github.com/PostHog/posthog-foss --skill review-hog-perspective-contracts-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pull request reviews often miss security vulnerabilities and breaking API changes because reviewers focus on logic and style. This Skill applies a dedicated Contracts & Security lens to PR chunks, catching injection risks, authz gaps, and schema mismatches before merge.

Core Features & Use Cases

  • Security Vulnerability Detection: Identifies SQL injection, XSS, prompt-injection risks, missing authentication/authorization checks, and sensitive data exposure in changed code.
  • API Contract Verification: Detects breaking changes such as removed or renamed fields, data-type changes, and GraphQL/REST contract violations.
  • Schema & Interface Alignment: Validates that database schemas match code models and that frontend/backend types stay consistent.
  • Use Case: A PR modifies a Django REST endpoint and its serializer. The Skill inspects the endpoint with ripgrep-based investigation commands, flags a missing permission check and a renamed response field that breaks API consumers, and reports only contract/security findings while other perspectives handle logic and performance.

Quick Start

Review this pull request chunk through the Contracts & Security perspective and report any security vulnerabilities or breaking API changes.

Frequently Asked Questions about review-hog-perspective-contracts-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for security vulnerabilities?▼

Apply a dedicated security review perspective that checks for SQL injection, XSS, prompt injection, missing authentication and authorization checks, and sensitive data exposure. Use ripgrep commands to locate endpoints, validation logic, and raw SQL queries in the changed code.

How to detect breaking API changes in a code review?▼

Check for changed request or response formats, removed or renamed fields, and data-type changes in the diff. Verify GraphQL and REST contract compliance and confirm version compatibility for existing API consumers.

What types of issues does a contracts and security review cover?▼

It covers injection vulnerabilities, XSS, authz gaps, missing input validation, schema mismatches, breaking API changes, and data-exposure risks. Logic errors, performance issues, and code style are explicitly left to other review perspectives.

Does this review perspective check test files for security issues?▼

No, findings are only raised on non-test files. Reference docs and frontend-only UI components without data handling are used for context but do not generate contract or security findings.

What are the limitations of a single-perspective security review?▼

It intentionally stays in its lane and does not report logic, correctness, or performance problems, which are handled by parallel perspectives. Overlapping findings across perspectives are resolved later by a separate deduplication step.

Related Skills

Explore More Software Engineering Skills→
kubb-labskubb-labs
1.8k

deslop

Removes AI-generated code slop from diffs to match repository conventions.

Official
Intermediate
YunosukeYoshinoYunosukeYoshino

review

Launch parallel code, performance, and specification review agents and consolidate findings.

Community
Advanced
PavkaBrikaPavkaBrika
1

parallel-code-review

Coordinate four read-only subagents to review a code diff from security, performance, correctness, and readability perspectives.

Community
Advanced
lamb92009lamb92009

security-reviewer

Identify vulnerabilities in code, configurations, and infrastructure with prioritized remediation guidance.

Community
Advanced