Reviews security including OWASP Top 10, input validation, auth. Use when junior builds login, authentication, stores passwords, handles user input, API keys, JWT tokens, or asks "is this secure".
"Security isn't a feature you add later. It's a foundation you build on."
This gate catches common security vulnerabilities before they reach production. Issues don't BLOCK, but generate strong WARNINGS.
"Where does user input enter this feature?"
Looking for:
Follow-up if input exists:
"How is that input validated before it's used?"
"What data does this feature access? Who should be able to access it?"
Looking for:
Follow-up:
"How do you verify the requesting user is allowed to access this data?"
"Are there any secrets, tokens, or sensitive data involved? Where are they stored?"
Looking for:
Review the code for these common issues:
eval() or new Function() with user inputinnerHTML with unsanitized user input✅ SECURITY GATE: PASSED
Security considerations addressed:
- Input validation: ✓
- Authorization checks: ✓
- No exposed secrets: ✓
Moving to the next gate...
⚠️ SECURITY GATE: WARNING
I found [X] security considerations to address:
**Issue 1: [Title]**
Location: `file.ts:42`
Risk: [What could go wrong]
Question: "What stops a malicious user from [attack scenario]?"
**Issue 2: [Title]**
Location: `file.ts:88`
Risk: [What could go wrong]
Suggestion: [Direction to fix, not the answer]
These should be fixed before this goes to production.
Would you like to address them now?
🚨 SECURITY GATE: CRITICAL WARNING
This needs attention before proceeding:
**CRITICAL: [Issue]**
Location: `file.ts:42`
Risk: [Severity explanation - data breach, account takeover, etc.]
This is the kind of vulnerability that makes news headlines.
Let's fix this before anything else.
❌ db.query(`SELECT * FROM users WHERE id = ${userId}`);
✅ db.query('SELECT * FROM users WHERE id = ?', [userId]);
❌ element.innerHTML = userInput;
✅ element.textContent = userInput;
❌ // Anyone can access any user's data
app.get('/users/:id', (req, res) => {
const user = await User.findById(req.params.id);
res.json(user);
});
✅ // Check ownership
app.get('/users/:id', (req, res) => {
const user = await User.findById(req.params.id);
if (user.id !== req.user.id) throw new ForbiddenError();
res.json(user);
});
❌ const apiKey = 'sk-live-abc123';
✅ const apiKey = process.env.API_KEY;
Instead of pointing out the fix, ask:
<script>alert('XSS')</script> as my name, what happens?"| Issue | Risk Level | Action | |-------|------------|--------| | SQL injection possible | CRITICAL | Must fix | | No rate limiting on auth | HIGH | Should fix | | Missing authorization check | HIGH | Should fix | | XSS possible | HIGH | Should fix | | Verbose error messages | MEDIUM | Recommend fix | | Missing input validation | MEDIUM | Recommend fix | | No CSRF protection | MEDIUM | Recommend fix | | CORS too permissive | LOW | Note for review |
npx skills add DanielPodolsky/security-fundamentals下载完整 Skill 目录，包含 SKILL.md 及所有相关文件
Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer