Agent Skills
› aiming-lab/MetaClaw
› secure-code-review
secure-code-review
GitHub提供安全代码审查清单，涵盖输入验证、凭证管理、依赖审计及权限控制等核心领域。用于在编写或审查处理用户输入、认证、文件I/O、网络请求及数据库查询的代码时，识别并防范常见安全漏洞。
Trigger Scenarios
代码审查涉及安全相关逻辑
检查硬编码密钥或敏感信息
评估输入验证与SQL注入风险
审查依赖包安全性
Install
npx skills add aiming-lab/MetaClaw --skill secure-code-review -g -y
SKILL.md
Frontmatter
{
"name": "secure-code-review",
"category": "coding",
"description": "Use this skill when reviewing or writing code that handles user input, authentication, file I\/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete."
}
Secure Code Review Checklist
Input Validation:
- Never trust user-supplied input; validate type, length, and format at boundaries.
- Use parameterized queries — never string-interpolate SQL.
- Sanitize before rendering HTML to prevent XSS.
Secrets & Credentials:
- No hardcoded passwords, API keys, or tokens in source code.
- Use environment variables or a secrets manager.
- Check
.gitignorebefore adding any config files.
Dependencies:
- Pin dependency versions; audit with
pip auditornpm audit. - Minimize surface area: remove unused packages.
Auth:
- Verify authorization on every protected endpoint, not just at login.
- Use short-lived tokens; implement refresh flows.
Version History
- 922caf3 Current 2026-07-25 11:08
