skills.rest
eylulsenakumral
eylulsenakumralCOMMUNITY
Explore all skills by this author →
GitHub

code-review-security

Review pull requests for OWASP Top 10 vulnerabilities in Python and React code.

Updated Jun 10, 2026
Search Tags:#static analysis#code review#react#fastapi#owasp#security review#vulnerability scanning
One-click install
npx skills add https://github.com/eylulsenakumral/auto-company-clean --skill code-review-security-eylulsenakumral
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review-security
Source: https://github.com/eylulsenakumral/auto-company-clean/tree/main/.claude/skills/code-review-security
Command: npx skills add https://github.com/eylulsenakumral/auto-company-clean --skill code-review-security-eylulsenakumral

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Security vulnerabilities like SQL injection, XSS, and hardcoded secrets often slip through code review because reviewers lack a systematic checklist and automated detection. This Skill provides a structured OWASP Top 10 review process plus an AST-based scanner that catches dangerous patterns in Python code before merge. ## Core Features & Use Cases - OWASP Top 10 Checklist: Review pull requests against all ten OWASP categories with concrete Python/FastAPI and React code examples showing vulnerable and secure patterns. - Automated AST Scanning: Run the included security-scan.py script to detect eval/exec calls, subprocess with shell=True, pickle deserialization, SQL f-string interpolation, unsafe yaml.load, weak hashing, and hardcoded secrets. - Severity-Classified Reports: Generate a security-review.md report with findings classified as Critical/High/Medium/Low, including file:line references, CWE mappings, and recommended fixes. - Use Case: Before merging a PR that adds a new FastAPI endpoint handling user input, activate this Skill to verify authorization checks, parameterized queries, rate limiting, and JWT expiration, then run the scanner to catch anything missed manually. ## Quick Start Review the current pull request for security vulnerabilities and write the findings to security-review.md.

Frequently Asked Questions about code-review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for security vulnerabilities?▼

Activate the Skill during PR review to walk through the OWASP Top 10 checklist covering access control, injection, cryptographic failures, and SSRF. Then run scripts/security-scan.py against the changed code to automatically detect dangerous patterns like eval(), shell=True, and hardcoded secrets.

How to detect SQL injection in Python code automatically?▼

Run python scripts/security-scan.py --path ./app to scan for f-strings containing SQL keywords like SELECT, INSERT, UPDATE, and DELETE. The AST-based scanner flags string-interpolated queries as critical findings and recommends parameterized queries or SQLAlchemy ORM filtering.

What security issues does the scanner detect in Python code?▼

The scanner detects eval/exec/compile calls, pickle.loads deserialization, subprocess with shell=True, yaml.load without SafeLoader, MD5/SHA1 password hashing, hardcoded secrets via regex, sensitive data in log statements, and JWT decoding with signature verification disabled.

Does this security review cover React frontend code?▼

Yes, the checklist includes React-specific checks for dangerouslySetInnerHTML XSS, javascript: URLs in hrefs, tokens stored in localStorage, and open redirects. However, the automated scanner only analyzes Python files; React patterns require manual review against the provided checklist.

When should I not use this security review checklist?▼

Do not use it for deployment infrastructure security, incident response, or general code quality review without a security focus. The Skill explicitly excludes Docker deployment hardening and incident handling, which belong to separate workflows.

Why does the security scanner exit with a failure code?▼

The scanner exits with code 1 when any critical or high severity findings are detected, making it suitable for CI/CD pipeline gates. It exits with code 0 only when no critical or high severity issues exist in the scanned path.

Related Skills

Explore More Software Engineering Skills→
Saisagar7779Saisagar7779
4

code-review

Review Python, FastAPI, and React code for correctness, security, and Resume Matcher standards.

Community
Advanced
DexploarerDexploarer
6

dependency-vulnerability-scanner

Scan dependency manifests and lockfiles for known vulnerabilities.

Community
Advanced
imDarshanGKimDarshanGK
11

docker-expert

Optimize Docker container configurations for security, performance, and deployment reliability.

Community
Advanced
MeoBakaMeoBaka

security-scanning-security-sast

Identify security weaknesses in source code using automated SAST tooling.

Community
Advanced