security

Review application code changes for security vulnerabilities and baseline controls.

Updated May 6, 2023

Search Tags:#code review #security #vulnerability #owasp #secure coding #threat modeling

Ready to run

npx skills add https://github.com/motoedie/.dotfiles --skill security-motoedie

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/motoedie/.dotfiles/tree/main/ai-tools/skills/security
Command: npx skills add https://github.com/motoedie/.dotfiles --skill security-motoedie

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a structured approach to identifying and mitigating security vulnerabilities in code changes, ensuring applications are built and maintained with robust security practices.

Core Features & Use Cases

Automated Security Reviews: Applies baseline security controls and targeted checks for common risk areas.
Vulnerability Identification: Detects issues related to input validation, authentication, authorization, secrets management, and more.
Use Case: Before merging a new feature that handles user uploads, use this Skill to perform a security review, identifying potential path traversal or file type validation flaws.

Quick Start

Use the security skill to review the code changes in the current commit for potential vulnerabilities.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security review on application code changes?▼

Perform a security review by applying baseline controls derived from OWASP to code changes, identifying vulnerabilities in untrusted input, authentication, sessions, and file operations before merging.

What is secure coding for untrusted input and database queries?▼

Secure coding for untrusted input involves validating data and parameterizing database queries to prevent injection attacks, ensuring applications enforce robust security practices during changes.

How do I check code for path traversal and file type validation flaws?▼

Check code for path traversal and file type validation flaws by reviewing file operations and user upload handling logic against secure coding standards to detect and mitigate potential risks.

Can I use automated security checks for secrets management and deserialization risks?▼

Use automated security checks to scan for secrets management and deserialization risks, applying targeted checks to detect hardcoded secrets and unsafe deserialization in application changes.

Does this approach identify dependency risks and command execution vulnerabilities?▼

This approach identifies dependency risks and command execution vulnerabilities by enforcing baseline security controls that address unsafe external library usage and improper command execution.