skills.rest
Jin9
Jin9COMMUNITY
Explore all skills by this author →
GitHub

reviewing-software-security

Reviews Go, Kafka, Kubernetes, and lending-system artifacts for defensive security findings mapped to OWASP and CWE.

Updated Apr 26, 2026
Search Tags:#owasp#threat modeling#go#kubernetes#security review#code audit#kafka
One-click install
npx skills add https://github.com/Jin9/skillify-foundation --skill reviewing-software-security-jin9
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reviewing-software-security
Source: https://github.com/Jin9/skillify-foundation/tree/main/treasury/reviewing-software-security
Command: npx skills add https://github.com/Jin9/skillify-foundation --skill reviewing-software-security-jin9

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security review of backend code, infrastructure config, and event-driven lending flows is slow and inconsistent when done ad hoc. This Skill standardizes defensive security review for Go/Gin services, Kafka consumers, MySQL/RDS, Kubernetes workloads, Kong/APISIX gateways, and CI/CD pipelines, producing prioritized findings tied to recognized standards instead of vague advice. ## Core Features & Use Cases - Structured review pipeline: An 11-step workflow from intake and trust-boundary mapping through threat enumeration, gap analysis, severity scoring, fix drafting, and validation planning. - Standards-mapped findings: Every finding cites OWASP ASVS, OWASP API Top 10 (2023), CWE Top 25, NIST SSDF, CIS Benchmarks, or SLSA, with severity and confidence labels and escalation floors. - Stack-specific taxonomy: Eleven review areas (A–K) covering application security, API gateways, DDD/CQRS architecture, AuthN/AuthZ, secrets, logging, databases, Kubernetes, CI/CD, Kafka, and lending data. - Use Case: Paste a Gin loan handler and ask "is this safe to merge" — the Skill detects the missing ownership check (BOLA), rates it Critical, and returns a compilable fix with tests, static-analysis rules, and a rollout plan. ## Quick Start Ask the agent to review the attached Gin handler, Kafka consumer, Kubernetes manifest, or Kong config for security issues and produce prioritized findings with fixes.

Frequently Asked Questions about reviewing-software-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Go Gin handler for security issues?▼

Paste the handler and ask for a security review. The Skill maps assets and trust boundaries, enumerates STRIDE threats, checks for patterns like BOLA and missing input validation, and returns findings with severity, a compilable fix, and validation tests.

How to check a Kafka consumer for double-disbursement risks?▼

Share the consumer code and ask for an event-driven security review. The Skill checks for idempotency keys, offset-commit ordering, and dedup constraints, then recommends a MySQL-backed idempotency table with a unique constraint on event_id.

What security standards does the review map findings to?▼

Findings cite OWASP ASVS, OWASP API Top 10 (2023), CWE Top 25, NIST SSDF, CIS Benchmarks, and SLSA. Every finding must reference at least one standard identifier, and lending-specific issues cite regulations like PDPA, GDPR, or PCI-DSS.

Can it review Kubernetes manifests and CI/CD pipelines?▼

Yes. It checks Deployments for runAsNonRoot, read-only root filesystems, NetworkPolicies, and RBAC scope, and reviews GitHub Actions for SHA pinning, OIDC vs long-lived credentials, and pull_request_target misuse.

Will it generate exploit code or attack payloads?▼

No. Hard safety rules prohibit exploits, payloads, detection evasion, and mass-targeting tooling. Refusals are brief and offer the nearest defensive alternative, such as the input-validation control that would block the attack class.

When should I not use this security review skill?▼

Skip it for pure UI/CSS changes, routine refactors, or dependency bumps without CVE context. It also declines stacks outside Go/Gin/Kafka/MySQL/Kubernetes/Kong/APISIX unless you explicitly request a best-effort cross-stack review.

Related Skills

Explore More Software Engineering Skills→
helmfilehelmfile
5.2k

helmfile

Manage Kubernetes Helm chart deployments declaratively with Helmfile.

Official
Advanced
SimyVSimyV

security

N/A

Community
Intermediate
ArMaTeCArMaTeC

security-reviewer

Identifies code vulnerabilities and generates severity-rated security audit reports with remediation guidance.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced