skills.rest
yellow-seed
yellow-seedCOMMUNITY
Explore all skills by this author →
GitHub

reviewing-security

Review code and configuration files against OWASP API Security Top 10 and version management risks.

1|Updated Feb 16, 2025
Search Tags:#code review#owasp#github actions#security review#dockerfile#vulnerability detection#version management
One-click install
npx skills add https://github.com/yellow-seed/my-portfolio --skill reviewing-security-yellow-seed
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reviewing-security
Source: https://github.com/yellow-seed/my-portfolio/tree/main/.github/skills/reviewing-security
Command: npx skills add https://github.com/yellow-seed/my-portfolio --skill reviewing-security-yellow-seed

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews often miss outdated tool versions in Dockerfiles, GitHub Actions workflows, and tool version files that dependabot or renovate cannot automatically verify, leaving EOL runtimes and known vulnerabilities undetected. ## Core Features & Use Cases - OWASP API Security Checks: Reviews code against OWASP API Security Top 10 (2023) risks including BOLA, broken authentication, excessive data exposure, and unrestricted resource consumption. - Version Management Audit: Detects outdated versions in Dockerfiles, GitHub Actions workflows, .nvmrc, .tool-versions, and Makefiles, flagging only EOL versions, known vulnerabilities, or major-version gaps. - Prioritized Reporting: Outputs a structured table with priority levels (high for EOL/vulnerabilities, medium for major version gaps) including current version, latest version, and status. - Use Case: Before merging a pull request, run this Skill to verify that the Dockerfile base image is not end-of-life and that GitHub Actions versions are current. ## Quick Start Review this repository for security vulnerabilities and outdated tool versions in Dockerfiles and CI workflows.

Frequently Asked Questions about reviewing-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check for outdated versions in Dockerfiles and GitHub Actions?▼

Run a version management audit that scans Dockerfile FROM images, apt-get or apk package pins, GitHub Actions uses: versions, and tool version files like .nvmrc. The check flags only EOL versions, known vulnerabilities, or major-version gaps, ignoring minor and patch differences.

What does an OWASP API Security Top 10 review cover?▼

It covers risks such as Broken Object Level Authorization (BOLA) via tenant_id validation, broken authentication in gRPC metadata, excessive data exposure in responses, and unrestricted resource consumption like missing file size limits or pagination.

Does this check package.json or go.mod dependencies?▼

No. Dependency manifest files like package.json, requirements.txt, and go.mod are excluded because dependabot or renovate already verifies them automatically. The audit targets only version specifications those tools cannot cover.

When should I update a flagged tool version?▼

Update immediately when a version is end-of-life or has a known security vulnerability. For major-version gaps, review release notes for breaking changes, update incrementally if skipping multiple majors, and always run tests after upgrading.

Why are minor version differences not reported?▼

Minor and patch version differences rarely introduce security risk or breaking changes, so reporting them creates noise. The audit limits findings to EOL versions, known vulnerabilities, and major-version gaps to keep results actionable.

Related Skills

Explore More Software Engineering Skills→
mykaarmamykaarma

scaffold-spring-boot-cicd

Generate Jenkinsfile, seed_groovy, Dockerfile templates for Spring Boot services and modules.

Official
Advanced
thrillmadethrillmade
1

critical-issues-only

Flag bugs, security vulnerabilities, and performance issues in pull requests.

Official
Intermediate
nrmnqddsnrmnqdds

golang-dependency-management

Automate Go dependency management, auditing, and vulnerability scanning with govulncheck.

Community
Advanced
MonumentalSystemsMonumentalSystems
17

vulnerability-scanning

Scan application code, dependencies, and container images for security vulnerabilities.

Official
Advanced