security-review

SKILL.md

"Assume the user is the attacker. Find where trust is misplaced."

| HIGH | Auth, crypto, external calls, value transfer, validation removal | | MEDIUM | Business logic, state changes, new public APIs | | LOW | Comments, tests, UI, logging |

| IDOR | User-controlled IDs without ownership check | | Mass Assignment | Binding request body directly to models | | SSRF | User-controlled URLs in server requests | | Path Traversal | User input in file paths without sanitization | | Race Condition | Check-then-use without locking | | Insecure Deserialization | Deserializing untrusted data |

在審查 PR 的安全性、審核代碼更改或分析潛在漏洞時使用。通過攻擊面映射和風險分類進行以安全為中心的代碼審查。觸發條件：“安全審查”、“使用安全模式”、“審核此”、“檢查漏洞”、“安全嗎”、“攻擊面”、“威脅模型”、“安全檢查”。只讀模式 - 識別問題但不解決它們。 來源：mcouthon/agents。

查看原文