reviewing-security
OWASP Top 10-based security review and vulnerability detection. Use when reviewing code for security issues, performing vulnerability analysis, or when user mentions security, OWASP, XSS, SQL injection, セキュリティ, 脆弱性.
安装与使用
请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。
查看来源 ↗使用指南技能说明
Security Review
Detection (OWASP Top 10)
| ID | Category | Pattern | Fix |
|---|---|---|---|
| A01 | Broken Access Control | Missing auth, IDOR, path traversal | Auth middleware, ownership check |
| A02 | Cryptographic Failures | password: 'plaintext' |
bcrypt/argon2 hashing |
| A03 | Injection | db.query(\SELECT...${id}`)` |
Parameterized query, ORM |
| A03 | Injection | exec(\ping ${host}`)` |
Input validation, library instead |
| A03 | XSS | dangerouslySetInnerHTML={{ __html }} |
Default escaping, DOMPurify |
| A05 | Security Misconfiguration | cors({ origin: '*' }) |
Explicit origin allowlist |
| A05 | Security Misconfiguration | cookie: {} (no options) |
secure, httpOnly, sameSite: 'strict' |
| A09 | Logging Failures | logger.info({ password }) |
Exclude sensitive fields |
| A10 | SSRF | fetch(userInputUrl) |
URL validation, allowlist |
Confidence Threshold
Report only when confidence >80%. Include: file:line, exploit scenario, fix recommendation.
References
| Topic | Scope | File |
|---|---|---|
| Basic | A01, A02, A07 | references/owasp-basic.md |
| Injection | A03 | references/owasp-injection.md |
| Advanced | A04-A06, A08-A10 | references/owasp-advanced.md |
| Cloud | IAM, IaC, CI/CD | references/cloud-infrastructure.md |
使用示例
查看来源仓库中的使用示例与配置说明。
查看来源 ↗来源历史
- 收录时间
- 2026-01-20
- 索引更新时间
- 2026-01-26
- Branch
- main
收录与同步日期属于本站记录。源码修改历史请查看来源仓库。
GitHub ↗chat Comments (0)
Sign in to join the discussion and leave a comment.
No comments yet. Be the first to share your thoughts!