mcpField
S
secure-code-review

secure-code-review

github.com/securityskillsSecurity01.3k installsUpdated 9w ago
Repository

About secure-code-review

Secure Code Review is a systematic code-review skill for identifying security vulnerabilities across data flows, access control, secrets, and state changes. It guides reviewers to report severity, affected paths, exploit sketches, and fixes.

Key features

  1. 01Map entry points and trust boundaries
  2. 02Trace untrusted data to sensitive sinks
  3. 03Audit authorization and object-level access
  4. 04Check secrets and cryptographic practices
  5. 05Inspect races and shared state

Use cases

  1. 01Review code changes for security risks
  2. 02Trace user input into queries or commands
  3. 03Check endpoint authorization and tenant isolation
  4. 04Write prioritized findings with remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill secure-code-review

After installing, type/secure-code-reviewin Claude Code to confirm it loaded.

Details

From the project README

Secure Code Review

Review code for vulnerabilities systematically, not line-by-line.

1. Orient

  • What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
  • Read the tests — what invariants do they reveal?
  • Check the diff's blast radius: auth logic? parsing? file handling? crypto?

2. Trace Untrusted Data

Follow each input from entry point to sink:

Sink ClassWhat to Verify
SQL/NoSQLParameterized; no string-built queries; identifiers whitelisted
Command execNo user data in shell strings; argv-array APIs; no shell=True
HTML/renderingContextual auto-escaping; raw/unsafe HTML flags justified
File pathsBasename/allowlist; canonicalize + prefix check; no user paths in includes
DeserializationTyped formats (JSON) over object serializers; validation post-parse
RedirectsRelative-only or allowlisted targets
Eval/dynamic codeJustified and input-free, or rejected

3. Audit Auth and Access Control

  • Every endpoint enforces authz server-side; role checks at the resource, not the controller only
  • Object-level checks (IDOR): does the query filter by the caller's tenant/user ID?
  • Session management: rotation, invalidation, secure cookie flags
  • Password reset flows: token entropy, expiry, single-use, no account enumeration

4. Audit Secrets and Config

  • No hardcoded credentials/keys/API tokens; no secrets in logs or error messages
  • Crypto: approved algorithms, library primitives (not hand-rolled), correct modes, random from CSPRNG

5. Race and State

  • TOCTOU on file checks, check-then-use on quotas/credits
  • Concurrency on mutable shared state; missing transactions on multi-step writes

Communication

Report findings with severity, the specific code path, an exploit sketch, and a suggested fix. Distinguish "must fix" from "harden later."

Comments

Markdown supported