security-review

SKILL.md

"Assume the user is the attacker. Find where trust is misplaced."

| HIGH | Auth, crypto, external calls, value transfer, validation removal | | MEDIUM | Business logic, state changes, new public APIs | | LOW | Comments, tests, UI, logging |

| IDOR | User-controlled IDs without ownership check | | Mass Assignment | Binding request body directly to models | | SSRF | User-controlled URLs in server requests | | Path Traversal | User input in file paths without sanitization | | Race Condition | Check-then-use without locking | | Insecure Deserialization | Deserializing untrusted data |

在审查 PR 的安全性、审核代码更改或分析潜在漏洞时使用。通过攻击面映射和风险分类进行以安全为中心的代码审查。触发条件：“安全审查”、“使用安全模式”、“审核此”、“检查漏洞”、“安全吗”、“攻击面”、“威胁模型”、“安全检查”。只读模式 - 识别问题但不解决它们。 来源：mcouthon/agents。

查看原文