code-review-security skillA
code-review-security is agent-read markdown (skill) from maxmiksa/auto-company: Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-bes.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# Code Review Security ## When to Use Activate this skill when: - Reviewing pull requests for security vulnerabilities - Auditing authentication or authorization code changes - Reviewing code that handles user input, file uploads, or external data - Checking for OWASP Top 10 vulnerabilities in new features - Validating that secrets are not committed to the repository - Scanning dependencies for known vulnerabilities - Reviewing API endpoints that expose sensitive data **Output:** Write findings to `security-review.md` with severity, file:line, description, and recommendations. Do NOT use this skill for: - Deployment infrastructure security (use `docker-best-practices`) - Incident response procedures (use `incident-response`) - General code quality review without security focus (use `pre-merge-checklist`) - Writing implementation code (use `python-backend-expert` or `react-frontend-expert`) ## Instructions ### OWASP Top 10 Checklist Review every PR against the OWASP Top 10 (2021 edition). Each category below includes specific checks for Python/FastAPI and React codebases. --- #### A01: Broken Access Control **What to look for:** - Missing authorization checks on endpoints …
Read the whole file at its exact version.
How to install
mdr add maxmiksa/auto-company/code-review-security@v1.0.0mdr add maxmiksa/auto-company/code-review-security@sha256:6a7d57ae5b2f014cPin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_4crjchsuawyru3ji)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.0.0 latest | 2026-01-09 | fb32ef5 | 15,621 B | A | view · diff |
| v1.0.0 | 2025-10-28 | dd7efbb | 10,780 B | A | view · diff |
| v1.0.0 | 2025-07-14 | 9c92ded | 5,492 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (15621 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
maxmiksa/auto-company · 3,095 stars · license MIT · pushed 2026-09-24 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_4crjchsuawyru3ji GET https://markdownregistry.com/api/v1/resolve?ref=maxmiksa/auto-company/code-review-security GET https://markdownregistry.com/api/v1/blob/6a7d57ae5b2f014c8b43b95500f391084f079d24c0157200cfc119caf79cd7b9
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
More from maxmiksa/auto-company
Every file in maxmiksa/auto-company