mcpField
C
code-review-security

code-review-security

github.com/owaspSecurity208419 installsUpdated 2w ago
Repository

About code-review-security

A security code-review skill for developers and reviewers. It guides a structured review across vulnerability classes and framework-specific checks, then formats findings with evidence, severity, and remediation.

Key features

  1. 01Scope and trust-boundary assessment
  2. 02Review by vulnerability class
  3. 03Framework-specific checks
  4. 04Diff-focused PR analysis
  5. 05Findings with fixes and confidence

Use cases

  1. 01Reviewing code changes in a pull request
  2. 02Assessing an application's security issues
  3. 03Preparing severity-ranked review findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/owasp/secure-agent-playbook --skill code-review-security

After installing, type/code-review-securityin Claude Code to confirm it loaded.

Details

From the project README

Security Code Review

Review code for security vulnerabilities by following the full procedure in plays/code-review-security.md.

Steps

  1. Scope & Context — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local).

  2. Systematic Review by Vulnerability Class (priority order):

    • Injection (A03) — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection
    • Authentication & Session (A07) — Hardcoded credentials, missing auth, weak sessions, JWT issues
    • Authorization (A01) — Missing authz checks, IDOR, horizontal/vertical privilege escalation
    • Cryptography (A02) — Weak algorithms, hardcoded keys, missing encryption, custom crypto
    • Data Exposure (A01) — Sensitive data in errors/logs, credentials in code, debug mode
    • Misconfiguration (A05) — Default credentials, permissive CORS, missing security headers
    • Deserialization (A08) — Untrusted deserialization, missing integrity checks, CSRF gaps

  3. Framework-Specific Checks — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go).

  4. Diff-Specific Analysis (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls.

  5. Produce Findings — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence.

Output

Scope summary, findings sorted by severity using templates/finding.md, positive observations (good security controls in place), and severity count table.

OWASP References

  • OWASP Top 10 (2021): A01-A10
  • OWASP ASVS v5.0
  • OWASP Code Review Guide
  • OWASP Cheat Sheet Series

Comments

Markdown supported