About

Imported from mastra-ai/mastra (templates/template-github-review-agent/workspace/skills/security-review/SKILL.md). Install upstream with npx skills add mastra-ai/mastra --skill security-review. Copyright stays with the author.

Security Review

Name: security-review
Author: mastra-ai

When reviewing code for security issues, check each category below. Reference the detailed checklist in references/security-checklist.md.

Injection Vulnerabilities

SQL injection: Look for string concatenation in database queries
Command injection: Check for unsanitized input passed to shell commands (exec, spawn)
XSS: Look for unsanitized user input rendered in HTML/templates
Path traversal: Check for user input in file paths without sanitization

Authentication & Authorization

Verify authentication checks on protected routes/endpoints
Ensure authorization checks match the required access level
Look for privilege escalation paths (e.g., user can modify other users' data)
Check that password/token comparison uses constant-time comparison

Secrets & Credentials

Hardcoded API keys, passwords, tokens, or connection strings
Secrets in configuration files that might be committed
Sensitive data in logs or error messages
Credentials passed via URL query parameters

Input Validation

Validate and sanitize all external input (user input, API responses, file contents)
Check for missing or weak input validation on API endpoints
Verify type coercion doesn't bypass validation
Look for overly permissive CORS or CSP configurations

Data Exposure

Sensitive data returned in API responses unnecessarily
PII or secrets in application logs
Information leakage in error messages (stack traces, internal paths)
Missing data encryption for sensitive fields

Severity Levels

🔴 CRITICAL: Exploitable vulnerability (injection, auth bypass, exposed secrets)
🟠 HIGH: Potential vulnerability that needs investigation
🟡 MEDIUM: Security weakness or missing best practice
🔵 LOW: Minor security improvement suggestion

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mastra-ai-mastra-security-review/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mastra-ai-mastra-security-review.ocm.jsonjson

{
  "ocm": "1",
  "id": "mastra-ai-mastra-security-review",
  "kind": "skill",
  "name": "security-review",
  "description": "Security-focused code review checklist for identifying vulnerabilities",
  "publisher": "mastra-ai",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "code-review",
      "security",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Security-focused code review checklist for identifying vulnerabilities"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mastra-ai/mastra",
      "path": "templates/template-github-review-agent/workspace/skills/security-review/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mastra-ai/mastra/blob/HEAD/templates/template-github-review-agent/workspace/skills/security-review/SKILL.md",
      "key": "mastra-ai/mastra/templates/template-github-review-agent/workspace/skills/security-review/SKILL.md"
    }
  },
  "instructions": "# Security Review\n\nWhen reviewing code for security issues, check each category below. Reference the detailed checklist in `references/security-checklist.md`.\n\n## Injection Vulnerabilities\n\n- SQL injection: Look for string concatenation in database queries\n- Command injection: Check for unsanitized input passed to shell commands (`exec`, `spawn`)\n- XSS: Look for unsanitized user input rendered in HTML/templates\n- Path traversal: Check for user input in file paths without sanitization\n\n## Authentication & Authorization\n\n- Verify authentication checks on protected routes/endpoints\n- Ensure autho",
  "cost": {
    "context_tokens": 454
  }
}

Fetch it by URL: GET /api/v1/registry/mastra-ai-mastra-security-review/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.