skills.rest
thachrocky12345
thachrocky12345COMMUNITY
Explore all skills by this author →
GitHub

security-code-review

Audits Django and Next.js codebases against OWASP Top 10 vulnerability categories.

Updated May 11, 2026
Search Tags:#owasp#next.js#security review#vulnerability scan#code audit#django#hipaa
One-click install
npx skills add https://github.com/thachrocky12345/local-agent-train-workstation --skill security-code-review-thachrocky12345
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-code-review
Source: https://github.com/thachrocky12345/local-agent-train-workstation/tree/main/.claude/skills/security-code-review
Command: npx skills add https://github.com/thachrocky12345/local-agent-train-workstation --skill security-code-review-thachrocky12345

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually auditing a Django backend and Next.js frontend for security vulnerabilities is slow and error-prone, especially in healthcare applications where HIPAA compliance makes every flaw a potential breach. This Skill automates OWASP Top 10 checks with ready-to-run grep and audit commands. ## Core Features & Use Cases - OWASP Top 10 Coverage: Runs targeted checks for each category from A01 (Broken Access Control) to A10 (SSRF), including IDOR detection, injection patterns, and missing security headers. - Healthcare Context: Each category includes HIPAA impact notes (e.g., 45 CFR 164.312 references) so findings map directly to compliance obligations. - Dependency Auditing: Runs pip-audit and yarn/npm audit to flag known CVEs in Django, Next.js, and other dependencies. - Use Case: Before deploying a new risk screening endpoint, run a scoped review to verify permission_classes are set, querysets filter by user ownership, and rate limiting exists. ## Quick Start Ask the AI to run a security review of the backend for OWASP category A01 broken access control issues.

Frequently Asked Questions about security-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an OWASP Top 10 security review on a Django app?▼

Run the security review workflow which executes targeted grep checks per OWASP category, such as finding views missing permission_classes for A01 or raw SQL usage for A03. You can scope it with flags like --category A01 or --scope backend.

How to detect IDOR vulnerabilities in Django REST views?▼

The A01 checks grep for direct pk lookups using request data without ownership filters, and for querysets missing user or care_provider scoping. This catches insecure direct object references in views like risk screening or video conferencing.

Does this check frontend Next.js code for XSS?▼

Yes, the A03 injection checks scan frontend TypeScript and JSX files for dangerouslySetInnerHTML usage, and the A07 checks look for JWT tokens stored in localStorage, which is XSS-accessible.

Can it audit Python and JavaScript dependencies for CVEs?▼

Yes, the A06 workflow runs pip-audit for the Django backend and yarn audit or npm audit for the Next.js frontend, plus checks pinned Django and Next.js versions against known vulnerabilities.

What are the limitations of grep-based security scanning?▼

Grep-based checks find pattern matches but cannot perform dataflow analysis, so they may produce false positives and miss vulnerabilities spanning multiple files. Findings should be manually verified before remediation.

Related Skills

Explore More Software Engineering Skills→
Aiden-KwakAiden-Kwak

github-integration

Integrate GitHub OAuth, repository creation, and file commits into Django and Next.js applications.

Community
Advanced
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
AnsteorraAnsteorra
6

security-audit

Perform static and dynamic security audits on the KMP application.

Official
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate