Agent Skills
› aiming-lab/MetaClaw
› secure-code-review
secure-code-review
GitHub用于代码审查与编写的安全检查技能，涵盖输入验证、凭据管理、依赖审计及权限控制，确保代码无常见安全漏洞。
Trigger Scenarios
代码审查
编写涉及用户输入或认证的代码
Install
npx skills add aiming-lab/MetaClaw --skill secure-code-review -g -y
SKILL.md
Frontmatter
{
"name": "secure-code-review",
"category": "coding",
"description": "Use this skill when reviewing or writing code that handles user input, authentication, file I\/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete."
}
Secure Code Review Checklist
Input Validation:
- Never trust user-supplied input; validate type, length, and format at boundaries.
- Use parameterized queries — never string-interpolate SQL.
- Sanitize before rendering HTML to prevent XSS.
Secrets & Credentials:
- No hardcoded passwords, API keys, or tokens in source code.
- Use environment variables or a secrets manager.
- Check
.gitignorebefore adding any config files.
Dependencies:
- Pin dependency versions; audit with
pip auditornpm audit. - Minimize surface area: remove unused packages.
Auth:
- Verify authorization on every protected endpoint, not just at login.
- Use short-lived tokens; implement refresh flows.
Version History
- 922caf3 Current 2026-07-25 11:08
