code-review-security

SKILL.md

Review every PR against the OWASP Top 10 (2021 edition). Each category below includes specific checks for Python/FastAPI and React codebases.

| eval(userinput) | Remote code execution | Remove or use ast.literaleval | | pickle.loads(data) | Arbitrary code execution | Use JSON or msgpack | | subprocess.run(cmd, shell=True) | Command injection | Pass args as list, shell=False | | yaml.load(data) | Code execution | Use yaml.safeload(data) |

| os.system(cmd) | Command injection | Use subprocess.run([...]) | | Raw SQL strings | SQL injection | Use ORM or parameterized queries | | hashlib.md5(password) | Weak hashing | Use bcrypt via passlib | | jwt.decode(token, options={"verifysignature": False}) | Auth bypass | Always verify signature |

Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-best-practices) or incident handling (use incident-response). Source: hieutrtr/ai1-skills.

View raw