security-review · diff
git:20260730.635bf65 to git:20261017.b913806
140 added, 463 removed. Audit A to A.
---
name: security-review
- description: Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
- origin: ECC
+ description: AI 驱动的代码库安全扫描器，像安全研究员一样推理代码：追踪数据流、理解组件交互、捕获模式匹配工具遗漏的漏洞。扫描安全漏洞、SQL 注入、XSS、命令注入、暴露的密钥、硬编码 secret、不安全依赖、访问控制问题时使用。
+ en_description: |-
+ 'AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.'
+ zh_displayName: 安全代码审查
+ category: 安全
+ en_category: Security
---
-
- # Security Review Skill
-
- This skill ensures all code follows security best practices and identifies potential vulnerabilities.
-
- ## When to Activate
-
- - Implementing authentication or authorization
- - Handling user input or file uploads
- - Creating new API endpoints
- - Working with secrets or credentials
- - Implementing payment features
- - Storing or transmitting sensitive data
- - Integrating third-party APIs
-
- ## Security Checklist
-
- ### 1. Secrets Management
-
- #### FAIL: NEVER Do This
- ```typescript
- const apiKey = "sk-proj-xxxxx" // Hardcoded secret
- const dbPassword = "password123" // In source code
- ```
-
- #### PASS: ALWAYS Do This
- ```typescript
- const apiKey = process.env.OPENAI_API_KEY
- const dbUrl = process.env.DATABASE_URL
-
- // Verify secrets exist
- if (!apiKey) {
- throw new Error('OPENAI_API_KEY not configured')
- }
- ```
-
- #### Verification Steps
- - [ ] No hardcoded API keys, tokens, or passwords
- - [ ] All secrets in environment variables
- - [ ] `.env.local` in .gitignore
- - [ ] No secrets in git history
- - [ ] Production secrets in hosting platform (Vercel, Railway)
-
- ### 2. Input Validation
-
- #### Always Validate User Input
- ```typescript
- import { z } from 'zod'
-
- // Define validation schema
- const CreateUserSchema = z.object({
- email: z.string().email(),
- name: z.string().min(1).max(100),
- age: z.number().int().min(0).max(150)
- })
-
- // Validate before processing
- export async function createUser(input: unknown) {
- try {
- const validated = CreateUserSchema.parse(input)
- return await db.users.create(validated)
- } catch (error) {
- if (error instanceof z.ZodError) {
- return { success: false, errors: error.errors }
- }
- throw error
- }
- }
- ```
-
- #### File Upload Validation
- ```typescript
- function validateFileUpload(file: File) {
- // Size check (5MB max)
- const maxSize = 5 * 1024 * 1024
- if (file.size > maxSize) {
- throw new Error('File too large (max 5MB)')
- }
-
- // Type check
- const allowedTypes = ['image/jpeg', 'image/png', 'image/gif']
- if (!allowedTypes.includes(file.type)) {
- throw new Error('Invalid file type')
- }
-
- // Extension check
- const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif']
- const extension = file.name.toLowerCase().match(/\.[^.]+$/)?.[0]
- if (!extension || !allowedExtensions.includes(extension)) {
- throw new Error('Invalid file extension')
- }
-
- return true
- }
- ```
-
- #### Verification Steps
- - [ ] All user inputs validated with schemas
- - [ ] File uploads restricted (size, type, extension)
- - [ ] No direct use of user input in queries
- - [ ] Whitelist validation (not blacklist)
- - [ ] Error messages don't leak sensitive info
-
- ### 3. SQL Injection Prevention
-
- #### FAIL: NEVER Concatenate SQL
- ```typescript
- // DANGEROUS - SQL Injection vulnerability
- const query = `SELECT * FROM users WHERE email = '${userEmail}'`
- await db.query(query)
- ```
-
- #### PASS: ALWAYS Use Parameterized Queries
- ```typescript
- // Safe - parameterized query
- const { data } = await supabase
- .from('users')
- .select('*')
- .eq('email', userEmail)
-
- // Or with raw SQL
- await db.query(
- 'SELECT * FROM users WHERE email = $1',
- [userEmail]
- )
- ```
-
- #### Verification Steps
- - [ ] All database queries use parameterized queries
- - [ ] No string concatenation in SQL
- - [ ] ORM/query builder used correctly
- - [ ] Supabase queries properly sanitized
-
- ### 4. Authentication & Authorization
-
- #### JWT Token Handling
- ```typescript
- // FAIL: WRONG: localStorage (vulnerable to XSS)
- localStorage.setItem('token', token)
-
- // PASS: CORRECT: httpOnly cookies
- res.setHeader('Set-Cookie',
- `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`)
- ```
-
- #### Authorization Checks
- ```typescript
- export async function deleteUser(userId: string, requesterId: string) {
- // ALWAYS verify authorization first
- const requester = await db.users.findUnique({
- where: { id: requesterId }
- })
-
- if (requester.role !== 'admin') {
- return NextResponse.json(
- { error: 'Unauthorized' },
- { status: 403 }
- )
- }
-
- // Proceed with deletion
- await db.users.delete({ where: { id: userId } })
- }
- ```
-
- #### Row Level Security (Supabase)
- ```sql
- -- Enable RLS on all tables
- ALTER TABLE users ENABLE ROW LEVEL SECURITY;
-
- -- Users can only view their own data
- CREATE POLICY "Users view own data"
- ON users FOR SELECT
- USING (auth.uid() = id);
-
- -- Users can only update their own data
- CREATE POLICY "Users update own data"
- ON users FOR UPDATE
- USING (auth.uid() = id);
- ```
-
- #### Verification Steps
- - [ ] Tokens stored in httpOnly cookies (not localStorage)
- - [ ] Authorization checks before sensitive operations
- - [ ] Row Level Security enabled in Supabase
- - [ ] Role-based access control implemented
- - [ ] Session management secure
-
- ### 5. XSS Prevention
-
- #### Sanitize HTML
- ```typescript
- import DOMPurify from 'isomorphic-dompurify'
-
- // ALWAYS sanitize user-provided HTML
- function renderUserContent(html: string) {
- const clean = DOMPurify.sanitize(html, {
- ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'p'],
- ALLOWED_ATTR: []
- })
- return <div dangerouslySetInnerHTML={{ __html: clean }} />
- }
- ```
-
- #### Content Security Policy
- ```typescript
- // next.config.js
- const securityHeaders = [
- {
- key: 'Content-Security-Policy',
- value: `
- default-src 'self';
- script-src 'self' 'unsafe-eval' 'unsafe-inline';
- style-src 'self' 'unsafe-inline';
- img-src 'self' data: https:;
- font-src 'self';
- connect-src 'self' https://api.example.com;
- `.replace(/\s{2,}/g, ' ').trim()
- }
- ]
- ```
-
- #### Verification Steps
- - [ ] User-provided HTML sanitized
- - [ ] CSP headers configured
- - [ ] No unvalidated dynamic content rendering
- - [ ] React's built-in XSS protection used
-
- ### 6. CSRF Protection
-
- #### CSRF Tokens
- ```typescript
- import { csrf } from '@/lib/csrf'
-
- export async function POST(request: Request) {
- const token = request.headers.get('X-CSRF-Token')
-
- if (!csrf.verify(token)) {
- return NextResponse.json(
- { error: 'Invalid CSRF token' },
- { status: 403 }
- )
- }
-
- // Process request
- }
- ```
-
- #### SameSite Cookies
- ```typescript
- res.setHeader('Set-Cookie',
- `session=${sessionId}; HttpOnly; Secure; SameSite=Strict`)
- ```
-
- #### Verification Steps
- - [ ] CSRF tokens on state-changing operations
- - [ ] SameSite=Strict on all cookies
- - [ ] Double-submit cookie pattern implemented
-
- ### 7. Rate Limiting
-
- #### API Rate Limiting
- ```typescript
- import rateLimit from 'express-rate-limit'
-
- const limiter = rateLimit({
- windowMs: 15 * 60 * 1000, // 15 minutes
- max: 100, // 100 requests per window
- message: 'Too many requests'
- })
-
- // Apply to routes
- app.use('/api/', limiter)
- ```
-
- #### Expensive Operations
- ```typescript
- // Aggressive rate limiting for searches
- const searchLimiter = rateLimit({
- windowMs: 60 * 1000, // 1 minute
- max: 10, // 10 requests per minute
- message: 'Too many search requests'
- })
-
- app.use('/api/search', searchLimiter)
- ```
-
- #### Verification Steps
- - [ ] Rate limiting on all API endpoints
- - [ ] Stricter limits on expensive operations
- - [ ] IP-based rate limiting
- - [ ] User-based rate limiting (authenticated)
-
- ### 8. Sensitive Data Exposure
-
- #### Logging
- ```typescript
- // FAIL: WRONG: Logging sensitive data
- console.log('User login:', { email, password })
- console.log('Payment:', { cardNumber, cvv })
-
- // PASS: CORRECT: Redact sensitive data
- console.log('User login:', { email, userId })
- console.log('Payment:', { last4: card.last4, userId })
- ```
-
- #### Error Messages
- ```typescript
- // FAIL: WRONG: Exposing internal details
- catch (error) {
- return NextResponse.json(
- { error: error.message, stack: error.stack },
- { status: 500 }
- )
- }
-
- // PASS: CORRECT: Generic error messages
- catch (error) {
- console.error('Internal error:', error)
- return NextResponse.json(
- { error: 'An error occurred. Please try again.' },
- { status: 500 }
- )
- }
- ```
-
- #### Verification Steps
- - [ ] No passwords, tokens, or secrets in logs
- - [ ] Error messages generic for users
- - [ ] Detailed errors only in server logs
- - [ ] No stack traces exposed to users
-
- ### 9. Blockchain Security (Solana)
+ # Security Review
- #### Wallet Verification
- ```typescript
- import { verify } from '@solana/web3.js'
+ An AI-powered security scanner that reasons about your codebase the way a human security
+ researcher would — tracing data flows, understanding component interactions, and catching
+ vulnerabilities that pattern-matching tools miss.
- async function verifyWalletOwnership(
- publicKey: string,
- signature: string,
- message: string
- ) {
- try {
- const isValid = verify(
- Buffer.from(message),
- Buffer.from(signature, 'base64'),
- Buffer.from(publicKey, 'base64')
- )
- return isValid
- } catch (error) {
- return false
- }
- }
- ```
+ ## When to Use This Skill
- #### Transaction Verification
- ```typescript
- async function verifyTransaction(transaction: Transaction) {
- // Verify recipient
- if (transaction.to !== expectedRecipient) {
- throw new Error('Invalid recipient')
- }
+ Use this skill when the request involves:
- // Verify amount
- if (transaction.amount > maxAmount) {
- throw new Error('Amount exceeds limit')
- }
+ - Scanning a codebase or file for security vulnerabilities
+ - Running a security review or vulnerability check
+ - Checking for SQL injection, XSS, command injection, or other injection flaws
+ - Finding exposed API keys, hardcoded secrets, or credentials in code
+ - Auditing dependencies for known CVEs
+ - Reviewing authentication, authorization, or access control logic
+ - Detecting insecure cryptography or weak randomness
+ - Performing a data flow analysis to trace user input to dangerous sinks
+ - Any request phrasing like "is my code secure?", "scan this file", or "check my repo for vulnerabilities"
+ - Running `/security-review` or `/security-review <path>`
- // Verify user has sufficient balance
- const balance = await getBalance(transaction.from)
- if (balance < transaction.amount) {
- throw new Error('Insufficient balance')
- }
+ ## How This Skill Works
- return true
- }
- ```
+ Unlike traditional static analysis tools that match patterns, this skill:
+ 1. **Reads code like a security researcher** — understanding context, intent, and data flow
+ 2. **Traces across files** — following how user input moves through your application
+ 3. **Self-verifies findings** — re-examines each result to filter false positives
+ 4. **Assigns severity ratings** — CRITICAL / HIGH / MEDIUM / LOW / INFO
+ 5. **Proposes targeted patches** — every finding includes a concrete fix
+ 6. **Requires human approval** — nothing is auto-applied; you always review first
- #### Verification Steps
- - [ ] Wallet signatures verified
- - [ ] Transaction details validated
- - [ ] Balance checks before transactions
- - [ ] No blind transaction signing
+ ## Execution Workflow
- ### 10. Dependency Security
+ Follow these steps **in order** every time:
- #### Regular Updates
- ```bash
- # Check for vulnerabilities
- npm audit
+ ### Step 1 — Scope Resolution
+ Determine what to scan:
+ - If a path was provided (`/security-review src/auth/`), scan only that scope
+ - If no path given, scan the **entire project** starting from the root
+ - Identify the language(s) and framework(s) in use (check package.json, requirements.txt,
+ go.mod, Cargo.toml, pom.xml, Gemfile, composer.json, etc.)
+ - Read `references/language-patterns.md` to load language-specific vulnerability patterns
- # Fix automatically fixable issues
- npm audit fix
+ ### Step 2 — Dependency Audit
+ Before scanning source code, audit dependencies first (fast wins):
+ - **Node.js**: Check `package.json` + `package-lock.json` for known vulnerable packages
+ - **Python**: Check `requirements.txt` / `pyproject.toml` / `Pipfile`
+ - **Java**: Check `pom.xml` / `build.gradle`
+ - **Ruby**: Check `Gemfile.lock`
+ - **Rust**: Check `Cargo.toml`
+ - **Go**: Check `go.sum`
+ - Flag packages with known CVEs, deprecated crypto libs, or suspiciously old pinned versions
+ - Read `references/vulnerable-packages.md` for a curated watchlist
- # Update dependencies
- npm update
+ ### Step 3 — Secrets & Exposure Scan
+ Scan ALL files (including config, env, CI/CD, Dockerfiles, IaC) for:
+ - Hardcoded API keys, tokens, passwords, private keys
+ - `.env` files accidentally committed
+ - Secrets in comments or debug logs
+ - Cloud credentials (AWS, GCP, Azure, Stripe, Twilio, etc.)
+ - Database connection strings with credentials embedded
+ - Read `references/secret-patterns.md` for regex patterns and entropy heuristics to apply
- # Check for outdated packages
- npm outdated
- ```
+ ### Step 4 — Vulnerability Deep Scan
+ This is the core scan. Reason about the code — don't just pattern-match.
+ Read `references/vuln-categories.md` for full details on each category.
- #### Lock Files
- ```bash
- # ALWAYS commit lock files
- git add package-lock.json
+ **Injection Flaws**
+ - SQL Injection: raw queries with string interpolation, ORM misuse, second-order SQLi
+ - XSS: unescaped output, dangerouslySetInnerHTML, innerHTML, template injection
+ - Command Injection: exec/spawn/system with user input
+ - LDAP, XPath, Header, Log injection
- # Use in CI/CD for reproducible builds
- npm ci # Instead of npm install
- ```
+ **Authentication & Access Control**
+ - Missing authentication on sensitive endpoints
+ - Broken object-level authorization (BOLA/IDOR)
+ - JWT weaknesses (alg:none, weak secrets, no expiry validation)
+ - Session fixation, missing CSRF protection
+ - Privilege escalation paths
+ - Mass assignment / parameter pollution
- #### Verification Steps
- - [ ] Dependencies up to date
- - [ ] No known vulnerabilities (npm audit clean)
- - [ ] Lock files committed
- - [ ] Dependabot enabled on GitHub
- - [ ] Regular security updates
+ **Data Handling**
+ - Sensitive data in logs, error messages, or API responses
+ - Missing encryption at rest or in transit
+ - Insecure deserialization
+ - Path traversal / directory traversal
+ - XXE (XML External Entity) processing
+ - SSRF (Server-Side Request Forgery)
- ## Security Testing
+ **Cryptography**
+ - Use of MD5, SHA1, DES for security purposes
+ - Hardcoded IVs or salts
+ - Weak random number generation (Math.random() for tokens)
+ - Missing TLS certificate validation
- ### Automated Security Tests
- ```typescript
- // Test authentication
- test('requires authentication', async () => {
- const response = await fetch('/api/protected')
- expect(response.status).toBe(401)
- })
+ **Business Logic**
+ - Race conditions (TOCTOU)
+ - Integer overflow in financial calculations
+ - Missing rate limiting on sensitive endpoints
+ - Predictable resource identifiers
- // Test authorization
- test('requires admin role', async () => {
- const response = await fetch('/api/admin', {
- headers: { Authorization: `Bearer ${userToken}` }
- })
- expect(response.status).toBe(403)
- })
+ ### Step 5 — Cross-File Data Flow Analysis
+ After the per-file scan, perform a **holistic review**:
+ - Trace user-controlled input from entry points (HTTP params, headers, body, file uploads)
+ all the way to sinks (DB queries, exec calls, HTML output, file writes)
+ - Identify vulnerabilities that only appear when looking at multiple files together
+ - Check for insecure trust boundaries between services or modules
- // Test input validation
- test('rejects invalid input', async () => {
- const response = await fetch('/api/users', {
- method: 'POST',
- body: JSON.stringify({ email: 'not-an-email' })
- })
- expect(response.status).toBe(400)
- })
+ ### Step 6 — Self-Verification Pass
+ For EACH finding:
+ 1. Re-read the relevant code with fresh eyes
+ 2. Ask: "Is this actually exploitable, or is there sanitization I missed?"
+ 3. Check if a framework or middleware already handles this upstream
+ 4. Downgrade or discard findings that aren't genuine vulnerabilities
+ 5. Assign final severity: CRITICAL / HIGH / MEDIUM / LOW / INFO
- // Test rate limiting
- test('enforces rate limits', async () => {
- const requests = Array(101).fill(null).map(() =>
- fetch('/api/endpoint')
- )
+ ### Step 7 — Generate Security Report
+ Output the full report in the format defined in `references/report-format.md`.
- const responses = await Promise.all(requests)
- const tooManyRequests = responses.filter(r => r.status === 429)
+ ### Step 8 — Propose Patches
+ For every CRITICAL and HIGH finding, generate a concrete patch:
+ - Show the vulnerable code (before)
+ - Show the fixed code (after)
+ - Explain what changed and why
+ - Preserve the original code style, variable names, and structure
+ - Add a comment explaining the fix inline
- expect(tooManyRequests.length).toBeGreaterThan(0)
- })
- ```
+ Explicitly state: **"Review each patch before applying. Nothing has been changed yet."**
- ## Pre-Deployment Security Checklist
+ ## Severity Guide
- Before ANY production deployment:
+ | Severity | Meaning | Example |
+ |----------|---------|---------|
+ | 🔴 CRITICAL | Immediate exploitation risk, data breach likely | SQLi, RCE, auth bypass |
+ | 🟠 HIGH | Serious vulnerability, exploit path exists | XSS, IDOR, hardcoded secrets |
+ | 🟡 MEDIUM | Exploitable with conditions or chaining | CSRF, open redirect, weak crypto |
+ | 🔵 LOW | Best practice violation, low direct risk | Verbose errors, missing headers |
+ | ⚪ INFO | Observation worth noting, not a vulnerability | Outdated dependency (no CVE) |
- - [ ] **Secrets**: No hardcoded secrets, all in env vars
- - [ ] **Input Validation**: All user inputs validated
- - [ ] **SQL Injection**: All queries parameterized
- - [ ] **XSS**: User content sanitized
- - [ ] **CSRF**: Protection enabled
- - [ ] **Authentication**: Proper token handling
- - [ ] **Authorization**: Role checks in place
- - [ ] **Rate Limiting**: Enabled on all endpoints
- - [ ] **HTTPS**: Enforced in production
- - [ ] **Security Headers**: CSP, X-Frame-Options configured
- - [ ] **Error Handling**: No sensitive data in errors
- - [ ] **Logging**: No sensitive data logged
- - [ ] **Dependencies**: Up to date, no vulnerabilities
- - [ ] **Row Level Security**: Enabled in Supabase
- - [ ] **CORS**: Properly configured
- - [ ] **File Uploads**: Validated (size, type)
- - [ ] **Wallet Signatures**: Verified (if blockchain)
+ ## Output Rules
- ## Resources
+ - **Always** produce a findings summary table first (counts by severity)
+ - **Never** auto-apply any patch — present patches for human review only
+ - **Always** include a confidence rating per finding (High / Medium / Low)
+ - **Group findings** by category, not by file
+ - **Be specific** — include file path, line number, and the exact vulnerable code snippet
+ - **Explain the risk** in plain English — what could an attacker do with this?
+ - If the codebase is clean, say so clearly: "No vulnerabilities found" with what was scanned
- - [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- - [Next.js Security](https://nextjs.org/docs/security)
- - [Supabase Security](https://supabase.com/docs/guides/auth)
- - [Web Security Academy](https://portswigger.net/web-security)
+ ## Reference Files
- ---
+ For detailed detection guidance, load the following reference files as needed:
- **Remember**: Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.
+ - `references/vuln-categories.md` — Deep reference for every vulnerability category with detection signals, safe patterns, and escalation checkers
+ - Search patterns: `SQL injection`, `XSS`, `command injection`, `SSRF`, `BOLA`, `IDOR`, `JWT`, `CSRF`, `secrets`, `cryptography`, `race condition`, `path traversal`
+ - `references/secret-patterns.md` — Regex patterns, entropy-based detection, and CI/CD secret risks
+ - Search patterns: `API key`, `token`, `private key`, `connection string`, `entropy`, `.env`, `GitHub Actions`, `Docker`, `Terraform`
+ - `references/language-patterns.md` — Framework-specific vulnerability patterns for JavaScript, Python, Java, PHP, Go, Ruby, and Rust
+ - Search patterns: `Express`, `React`, `Next.js`, `Django`, `Flask`, `FastAPI`, `Spring Boot`, `PHP`, `Go`, `Rails`, `Rust`
+ - `references/vulnerable-packages.md` — Curated CVE watchlist for npm, pip, Maven, Rubygems, Cargo, and Go modules
+ - Search patterns: `lodash`, `axios`, `jsonwebtoken`, `Pillow`, `log4j`, `nokogiri`, `CVE`
+ - `references/report-format.md` — Structured output template for security reports with finding cards, dependency audit, secrets scan, and patch proposal formatting
+ - Search patterns: `report`, `format`, `template`, `finding`, `patch`, `summary`, `confidence`