Security Review

GitHubOfficialFirst committed by Mrigank005Distributed by GitHub

Skill
Review and audit
Security
MIT
Medium risk

From the author

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

— the description by Mrigank005

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Security Review is an advanced auditing tool that mimics a human security researcher's approach to codebase analysis. Rather than relying on simple pattern matching, it performs holistic data flow analysis to trace user input to dangerous sinks, understands component interactions, and verifies findings to reduce false positives. It covers a wide range of security concerns including injection flaws, authentication and access control issues, insecure cryptography, and business logic vulnerabilities across multiple programming languages.

What it does

Performs deep data flow analysis to trace user input to dangerous sinks
Audits project dependencies for known CVEs
Scans for hardcoded secrets, API keys, and credentials
Identifies injection flaws, authentication bugs, and business logic issues
Provides severity ratings and concrete patch proposals for critical findings
Filters results through a self-verification pass to minimize false positives

When to use it

When you need to audit a codebase for security vulnerabilities
Before deploying code to production to check for exposed secrets
When investigating potential injection flaws like SQLi or XSS
To review authentication and authorization logic
When checking for insecure dependencies or outdated libraries

Advantages

Context-aware analysis that understands intent and component interactions
Reduces noise by self-verifying findings before reporting
Provides actionable, language-specific patch proposals
Covers a broad spectrum of vulnerabilities beyond simple syntax patterns
Supports multiple major programming languages and frameworks

Usage examples

“security-review src/auth/”: The agent scans only the authentication module, identifying potential BOLA or missing auth checks and providing patches for any high-severity findings.
“Is my code secure?”: The agent performs a full project audit, including dependency checks, a secrets scan, and a deep vulnerability analysis, outputting a structured security report.
“Check my repo for vulnerabilities”: The agent conducts a comprehensive security review of the entire codebase, grouping findings by category and providing a summary table with severity levels.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/security-review/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip security-review.zip -d .agents/skills

Documentation by Mrigank005

Security Review

An AI-powered security scanner that reasons about your codebase the way a human security researcher would — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss.

When to Use This Skill

Use this skill when the request involves:

Scanning a codebase or file for security vulnerabilities
Running a security review or vulnerability check
Checking for SQL injection, XSS, command injection, or other injection flaws
Finding exposed API keys, hardcoded secrets, or credentials in code
Auditing dependencies for known CVEs
Reviewing authentication, authorization, or access control logic
Detecting insecure cryptography or weak randomness
Performing a data flow analysis to trace user input to dangerous sinks
Any request phrasing like "is my code secure?", "scan this file", or "check my repo for vulnerabilities"
Running /security-review or /security-review <path>

How This Skill Works

Unlike traditional static analysis tools that match patterns, this skill:

Reads code like a security researcher — understanding context, intent, and data flow
Traces across files — following how user input moves through your application
Self-verifies findings — re-examines each result to filter false positives
Assigns severity ratings — CRITICAL / HIGH / MEDIUM / LOW / INFO
Proposes targeted patches — every finding includes a concrete fix
Requires human approval — nothing is auto-applied; you always review first

Execution Workflow

Follow these steps in order every time:

Step 1 — Scope Resolution

Determine what to scan:

If a path was provided (/security-review src/auth/), scan only that scope
If no path given, scan the entire project starting from the root
Identify the language(s) and framework(s) in use (check package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, Gemfile, composer.json, etc.)
Read references/language-patterns.md to load language-specific vulnerability patterns

Step 2 — Dependency Audit

Before scanning source code, audit dependencies first (fast wins):

Node.js: Check package.json + package-lock.json for known vulnerable packages
Python: Check requirements.txt / pyproject.toml / Pipfile
Java: Check pom.xml / build.gradle
Ruby: Check Gemfile.lock
Rust: Check Cargo.toml
Go: Check go.sum
Flag packages with known CVEs, deprecated crypto libs, or suspiciously old pinned versions
Read references/vulnerable-packages.md for a curated watchlist

Step 3 — Secrets & Exposure Scan

Scan ALL files (including config, env, CI/CD, Dockerfiles, IaC) for:

Hardcoded API keys, tokens, passwords, private keys
.env files accidentally committed
Secrets in comments or debug logs
Cloud credentials (AWS, GCP, Azure, Stripe, Twilio, etc.)
Database connection strings with credentials embedded
Read references/secret-patterns.md for regex patterns and entropy heuristics to apply

Step 4 — Vulnerability Deep Scan

This is the core scan. Reason about the code — don't just pattern-match. Read references/vuln-categories.md for full details on each category.

Injection Flaws

SQL Injection: raw queries with string interpolation, ORM misuse, second-order SQLi
XSS: unescaped output, dangerouslySetInnerHTML, innerHTML, template injection
Command Injection: exec/spawn/system with user input
LDAP, XPath, Header, Log injection

Authentication & Access Control

Missing authentication on sensitive endpoints
Broken object-level authorization (BOLA/IDOR)
JWT weaknesses (alg:none, weak secrets, no expiry validation)
Session fixation, missing CSRF protection
Privilege escalation paths
Mass assignment / parameter pollution

Data Handling

Sensitive data in logs, error messages, or API responses
Missing encryption at rest or in transit
Insecure deserialization
Path traversal / directory traversal
XXE (XML External Entity) processing
SSRF (Server-Side Request Forgery)

Cryptography

Use of MD5, SHA1, DES for security purposes
Hardcoded IVs or salts
Weak random number generation (Math.random() for tokens)
Missing TLS certificate validation

Business Logic

Race conditions (TOCTOU)
Integer overflow in financial calculations
Missing rate limiting on sensitive endpoints
Predictable resource identifiers

Step 5 — Cross-File Data Flow Analysis

After the per-file scan, perform a holistic review:

Trace user-controlled input from entry points (HTTP params, headers, body, file uploads) all the way to sinks (DB queries, exec calls, HTML output, file writes)
Identify vulnerabilities that only appear when looking at multiple files together
Check for insecure trust boundaries between services or modules

Step 6 — Self-Verification Pass

For EACH finding:

Re-read the relevant code with fresh eyes
Ask: "Is this actually exploitable, or is there sanitization I missed?"
Check if a framework or middleware already handles this upstream
Downgrade or discard findings that aren't genuine vulnerabilities
Assign final severity: CRITICAL / HIGH / MEDIUM / LOW / INFO

Step 7 — Generate Security Report

Output the full report in the format defined in references/report-format.md.

Step 8 — Propose Patches

For every CRITICAL and HIGH finding, generate a concrete patch:

Show the vulnerable code (before)
Show the fixed code (after)
Explain what changed and why
Preserve the original code style, variable names, and structure
Add a comment explaining the fix inline

Explicitly state: "Review each patch before applying. Nothing has been changed yet."

Severity Guide

Severity	Meaning	Example
🔴 CRITICAL	Immediate exploitation risk, data breach likely	SQLi, RCE, auth bypass
🟠 HIGH	Serious vulnerability, exploit path exists	XSS, IDOR, hardcoded secrets
🟡 MEDIUM	Exploitable with conditions or chaining	CSRF, open redirect, weak crypto
🔵 LOW	Best practice violation, low direct risk	Verbose errors, missing headers
⚪ INFO	Observation worth noting, not a vulnerability	Outdated dependency (no CVE)

Output Rules

Always produce a findings summary table first (counts by severity)
Never auto-apply any patch — present patches for human review only
Always include a confidence rating per finding (High / Medium / Low)
Group findings by category, not by file
Be specific — include file path, line number, and the exact vulnerable code snippet
Explain the risk in plain English — what could an attacker do with this?
If the codebase is clean, say so clearly: "No vulnerabilities found" with what was scanned

Reference Files

For detailed detection guidance, load the following reference files as needed:

references/vuln-categories.md — Deep reference for every vulnerability category with detection signals, safe patterns, and escalation checkers
- Search patterns: SQL injection, XSS, command injection, SSRF, BOLA, IDOR, JWT, CSRF, secrets, cryptography, race condition, path traversal
references/secret-patterns.md — Regex patterns, entropy-based detection, and CI/CD secret risks
- Search patterns: API key, token, private key, connection string, entropy, .env, GitHub Actions, Docker, Terraform
references/language-patterns.md — Framework-specific vulnerability patterns for JavaScript, Python, Java, PHP, Go, Ruby, and Rust
- Search patterns: Express, React, Next.js, Django, Flask, FastAPI, Spring Boot, PHP, Go, Rails, Rust
references/vulnerable-packages.md — Curated CVE watchlist for npm, pip, Maven, Rubygems, Cargo, and Go modules
- Search patterns: lodash, axios, jsonwebtoken, Pillow, log4j, nokogiri, CVE
references/report-format.md — Structured output template for security reports with finding cards, dependency audit, secrets scan, and patch proposal formatting
- Search patterns: report, format, template, finding, patch, summary, confidence

Files

ATTRIBUTION.mdAdded by AutoGineer867 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md8.9 KiB
references/language-patterns.md5.2 KiB
references/report-format.md6.6 KiB
references/secret-patterns.md3.4 KiB
references/vuln-categories.md7.7 KiB
references/vulnerable-packages.md3.9 KiB

references/language-patterns.md

Language-Specific Vulnerability Patterns

Load the relevant section during Step 1 (Scope Resolution) after identifying languages.

JavaScript / TypeScript (Node.js, React, Next.js, Express)

Critical APIs/calls to flag

eval()                    // arbitrary code execution
Function('return ...')   // same as eval
child_process.exec()     // command injection if user input reaches it
fs.readFile              // path traversal if user controls path
fs.writeFile             // path traversal if user controls path

Express.js specific

// Missing helmet (security headers)
const app = express()
// Should have: app.use(helmet())

// Body size limits missing (DoS)
app.use(express.json())
// Should have: app.use(express.json({ limit: '10kb' }))

// CORS misconfiguration
app.use(cors({ origin: '*' }))  // too permissive
app.use(cors({ origin: req.headers.origin }))  // reflects any origin

// Trust proxy without validation
app.set('trust proxy', true)  // only safe behind known proxy

React specific

<div dangerouslySetInnerHTML={{ __html: userContent }} />  // XSS
<a href={userUrl}>link</a>  // javascript: URL injection

Next.js specific

// Server Actions without auth
export async function deleteUser(id) {   // missing: auth check
  await db.users.delete(id)
}

// API Routes missing method validation
export default function handler(req, res) {
  // Should check: if (req.method !== 'POST') return res.status(405)
  doSensitiveAction()
}

Python (Django, Flask, FastAPI)

Django specific

# Raw SQL
User.objects.raw(f"SELECT * FROM users WHERE name = '{name}'")  # SQLi

# Missing CSRF
@csrf_exempt  # Only OK for APIs with token auth

# Debug mode in production
DEBUG = True  # in settings.py — exposes stack traces

# SECRET_KEY
SECRET_KEY = 'django-insecure-...'  # must be changed for production

# ALLOWED_HOSTS
ALLOWED_HOSTS = ['*']  # too permissive

Flask specific

# Debug mode
app.run(debug=True)  # never in production

# Secret key
app.secret_key = 'dev'  # weak

# eval/exec with user input
eval(request.args.get('expr'))

# render_template_string with user input (SSTI)
render_template_string(f"Hello {name}")  # Server-Side Template Injection

FastAPI specific

# Missing auth dependency
@app.delete("/users/{user_id}")  # No Depends(get_current_user)
async def delete_user(user_id: int):
    ...

# Arbitrary file read
@app.get("/files/{filename}")
async def read_file(filename: str):
    return FileResponse(f"uploads/{filename}")  # path traversal

Java (Spring Boot)

Spring Boot specific

// SQL Injection
String query = "SELECT * FROM users WHERE name = '" + name + "'";
jdbcTemplate.query(query, ...);

// XXE
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
// Missing: dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)

// Deserialization
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();  // only safe with allowlist

// Spring Security — permitAll on sensitive endpoint
.antMatchers("/admin/**").permitAll()

// Actuator endpoints exposed
management.endpoints.web.exposure.include=*  # in application.properties

PHP

// Direct user input in queries
$result = mysql_query("SELECT * FROM users WHERE id = " . $_GET['id']);

// File inclusion
include($_GET['page'] . ".php");  // local/remote file inclusion

// eval
eval($_POST['code']);

// extract() with user input
extract($_POST);  // overwrites any variable

// Loose comparison
if ($password == "admin") {}  // use === instead

// Unserialize
unserialize($_COOKIE['data']);  // remote code execution

Go

// Command injection
exec.Command("sh", "-c", userInput)

// SQL injection
db.Query("SELECT * FROM users WHERE name = '" + name + "'")

// Path traversal
filePath := filepath.Join("/uploads/", userInput)  // sanitize userInput first

// Insecure TLS
http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}

// Goroutine leak / missing context cancellation
go func() {
  // No done channel or context
  for { ... }
}()

Ruby on Rails

# SQL injection (safe alternatives use placeholders)
User.where("name = '#{params[:name]}'")  # VULNERABLE
User.where("name = ?", params[:name])   # SAFE

# Mass assignment without strong params
@user.update(params[:user])  # should be params.require(:user).permit(...)

# eval / send with user input
eval(params[:code])
send(params[:method])  # arbitrary method call

# Redirect to user-supplied URL (open redirect)
redirect_to params[:url]

# YAML.load (allows arbitrary object creation)
YAML.load(user_input)  # use YAML.safe_load instead

Rust

// Unsafe blocks — flag for manual review
unsafe {
    // Reason for unsafety should be documented
}

// Integer overflow (debug builds panic, release silently wraps)
let result = a + b;  // use checked_add/saturating_add for financial math

// Unwrap/expect in production code (panics on None/Err)
let value = option.unwrap();  // prefer ? or match

// Deserializing arbitrary types
serde_json::from_str::<serde_json::Value>(&user_input)  // generally safe
// But: bincode::deserialize from untrusted input — can be exploited

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

What our scanner noticed· Medium risk

References to credential files

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

First committed by

Mrigank005

Publisher

GitHub (Official)

Distributed by

GitHub

Source

github/awesome-copilot · skills/security-review · commit 797337f

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Contributors

Mrigank005

AutoGineer is not affiliated with or endorsed by Mrigank005 or GitHub.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download security-review.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Mrigank005

Security Review

When to Use This Skill

How This Skill Works

Execution Workflow

Step 1 — Scope Resolution

Step 2 — Dependency Audit

Step 3 — Secrets & Exposure Scan

Step 4 — Vulnerability Deep Scan

Step 5 — Cross-File Data Flow Analysis

Step 6 — Self-Verification Pass

Step 7 — Generate Security Report

Step 8 — Propose Patches

Severity Guide

Output Rules

Reference Files

Files

references/language-patterns.md

Language-Specific Vulnerability Patterns

JavaScript / TypeScript (Node.js, React, Next.js, Express)

Critical APIs/calls to flag

Express.js specific

React specific

Next.js specific

Python (Django, Flask, FastAPI)

Django specific

Flask specific

FastAPI specific

Java (Spring Boot)

Spring Boot specific

PHP

Go

Ruby on Rails

Rust

Requirements and compatibility

Security

Attribution and licence

Related skills

Security Audit

Sast Configuration

Firmware Analyst

Policy Enforcer

Backend Development Security Auditor

Memory Forensics

Download ZIP