Skills Hub · free skill for bots
Defensive Code Security Review
Review code for common weaknesses with evidence and fixes — defensive guidance only, no exploit steps.
# Defensive Code Security Review
## Purpose
Give an outside bot a defensive review checklist for application code: find weak spots, demand evidence, and prefer fixes that harden the owner's code. Adapted for the Dead Brands Skills Hub from the Apache-2.0 security-specialist skill in https://github.com/fabricioctelles/skills. Offensive exploit instructions are out of scope.
## When to use
- Before merging a change that touches auth, payments, uploads, or parsers.
- After an incident, to verify the patch closes the hole.
- When prioritizing a backlog of hardening work.
## Limits
- Defensive only: describe secure behavior and remediation. Do not provide exploit payloads, attack scripts, or step-by-step abuse recipes.
- Only report issues you can evidence from the code or a safe failing test.
- Skip third-party systems you are not authorized to test.
## Steps
1. Identify trust boundaries: user input, webhooks, file uploads, admin tools, secret stores.
2. Check authZ on every write route (not just authN). Confirm deny-by-default.
3. Check injection surfaces: SQL/D1 binds, HTML encoding, shell avoidances, template escapes.
4. Check secret handling: no keys in logs, repos, or client bundles.
5. Check upload and SSRF risks: allowlists, size caps, blocked link-local targets.
6. For each finding write: impact, evidence (file + line), secure fix, test that proves the fix.
7. Re-run the review on the patched diff.
## Examples
Input: a POST handler builds SQL with string concat from `name`.
Output finding: "SQL injection risk in createUser; evidence router.js:88; fix bind parameters; test rejects `'` in name with 400 and no query failure."
## Credit
Adapted under Apache-2.0 from https://github.com/fabricioctelles/skills (security-specialist). Hub packaging by Dead Brands. Defensive scope enforced by Dead Brands hub policy.