skills.rest
edhoferdian
edhoferdianCOMMUNITY
Explore all skills by this author →
GitHub

security-review-edho-ferdian

Reviews code for security vulnerabilities using OWASP-style checklists and scanner verification.

2|Updated Sep 6, 2026
Search Tags:#owasp#penetration testing#security review#code audit#sast#vulnerability detection#secure code
One-click install
npx skills add https://github.com/edhoferdian/EEF --skill security-review-edho-ferdian-edhoferdian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-edho-ferdian
Source: https://github.com/edhoferdian/EEF/tree/main/.agents/skills/security-review-edho-ferdian
Command: npx skills add https://github.com/edhoferdian/EEF --skill security-review-edho-ferdian-edhoferdian

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security review criteria are often scattered across projects and go out of sync, and reviewers frequently flag theoretical issues while missing exploitable ones. This Skill provides a single source of truth for security review criteria, running a structured audit that verifies findings with real scanners instead of guessing. ## Core Features & Use Cases - General OWASP-style checklist (SEC-01..19): Covers input sanitization, secret exposure, injection, IDOR, mass assignment, ReDoS, path traversal, open redirect, and more, with a reachability gate that caps severity when a sink is not actually exploitable. - Stack- and domain-specific depth: Dedicated criteria for React, Python, FastAPI, Django, NestJS, Angular, Laravel, Spring Boot, and Solidity/EVM, plus database/RLS, healthcare PHI, LLM agent pipelines, containers, cloud/IaC/CI-CD, and agent-harness configuration. - Ground-truth verification: Runs real tools (bandit, pip-audit, npm audit, gitleaks, trufflehog, checkov) and labels every finding with an honest confidence level. - Use Case: Ask for a security audit of a Django API change set; the Skill detects the stack, applies the general plus Django-specific checklists, runs bandit and manage.py check --deploy, and produces a severity-ranked SECURITY REVIEW REPORT with concrete fixes. ## Quick Start Ask the assistant to run a security review on the current code changes and report any vulnerabilities with severity and fixes.

Frequently Asked Questions about security-review-edho-ferdian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my code with this Skill?▼

Ask for a security review, security audit, or vulnerability check on a file, module, or git diff. The Skill detects your stack, applies the general SEC-01..19 checklist plus stack-specific criteria, runs available scanners, and produces a severity-ranked report.

What security vulnerabilities does the checklist cover?▼

The general checklist covers injection, XSS, SSRF, IDOR, secret exposure, mass assignment, ReDoS, path traversal, open redirect, CSRF/CORS, session fixation, and insecure deserialization. Stack sections add framework-specific issues like Django DEBUG mode or React dangerouslySetInnerHTML.

Does it support smart contract and Solidity security review?▼

Yes, the language-specific reference includes a Solidity/EVM section with dedicated SC-SEC codes for smart contract security, plus general EVM security knowledge for items not otherwise covered.

How are false positives avoided in security findings?▼

Every HIGH or CRITICAL finding passes a reachability gate checking whether the sink is actually reachable and attacker-controlled, plus a common-false-positives list covering placeholder secrets, test credentials, and non-security MD5 usage. Findings are labeled by confidence level.

Which scanning tools does the security review use?▼

It runs bandit and pip-audit for Python, npm audit and ESLint security plugin for JavaScript/TypeScript, and gitleaks or trufflehog for secret detection. When a scanner is unavailable, findings are labeled as needing verification rather than asserted.

Can it review infrastructure, Docker, and CI/CD security?▼

Yes, dedicated domain sections cover Dockerfile and Compose hardening, Terraform and IAM over-permissioning, CI/CD credential exposure, and agent-harness configuration risks like over-permissive tool allowlists and hook command injection.

Related Skills

Explore More Software Engineering Skills→
JerrylalalaJerrylalala
6

setup

Configure review agents for a project by auto-detecting the stack and writing compound-engineering.local.md.

Community
Intermediate
thrawn01thrawn01
11

review-validate

Validate reported bugs with parallel sub-agents and surface tests.

Community
Advanced
nexus-substratenexus-substrate
18

reviewing-code

Review PR diffs against correctness, readability, architecture, security, and performance.

Official
Advanced
AI-SafeterAI-Safeter
10

sast-configuration

Configure and automate SAST tooling for CI/CD vulnerability detection.

Community
Advanced