Agent Skills › mastra-ai/mastra › security-review

security-review

GitHub

提供安全代码审查清单，涵盖注入、认证、密钥等风险点，辅助识别漏洞并评估严重程度。

templates/template-github-review-agent/workspace/skills/security-review/SKILL.md mastra-ai/mastra

Trigger Scenarios

进行代码安全审计检查潜在的安全漏洞

Install

npx skills add mastra-ai/mastra --skill security-review -g -y

More Options

Non-standard path

npx skills add https://github.com/mastra-ai/mastra/tree/main/templates/template-github-review-agent/workspace/skills/security-review -g -y

Use without installing

npx skills use mastra-ai/mastra@security-review

指定 Agent (Claude Code)

npx skills add mastra-ai/mastra --skill security-review -a claude-code -g -y

安装 repo 全部 skill

npx skills add mastra-ai/mastra --all -g -y

预览 repo 内 skill

npx skills add mastra-ai/mastra --list

SKILL.md

Frontmatter

{
    "name": "security-review",
    "version": "1.0.0",
    "metadata": {
        "tags": [
            "code-review",
            "security"
        ]
    },
    "description": "Security-focused code review checklist for identifying vulnerabilities"
}

Security Review

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

SQL injection: Look for string concatenation in database queries
Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
XSS: Look for unsanitized user input rendered in HTML/templates
Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

Verify authentication checks on protected routes/endpoints
Ensure authorization checks match the required access level
Look for privilege escalation paths (e.g., user can modify other users' data)
Check that password/token comparison uses constant-time comparison

Secrets & Credentials

Hardcoded API keys, passwords, tokens, or connection strings
Secrets in configuration files that might be committed
Sensitive data in logs or error messages
Credentials passed via URL query parameters

Input Validation

Validate and sanitize all external input (user input, API responses, file contents)
Check for missing or weak input validation on API endpoints
Verify type coercion doesn't bypass validation
Look for overly permissive CORS or CSP configurations

Data Exposure

Sensitive data returned in API responses unnecessarily
PII or secrets in application logs
Information leakage in error messages (stack traces, internal paths)
Missing data encryption for sensitive fields

Severity Levels

🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
🟠 HIGH: Potential vulnerability that needs investigation
🟡 MEDIUM: Security weakness or missing best practice
🔵 LOW: Minor security improvement suggestion