verify-code— agent skill

Perform a security review of the following code:

$ARGUMENTS

What to do

Review the code provided in the arguments above. If no code was provided, ask the user to paste the code or specify a file path to read. If a file path is mentioned, read the file first.

Step 1 — Detect Technologies

Identify language and frameworks from:

• File extension: .py → Python, .ts/.tsx → TypeScript, .go → Go, .java → Java, .rb → Ruby, .php → PHP, .sql → SQL
• Import statements: import django, require('express'), import React, use actix_web
• Syntax patterns: def/class → Python, func → Go, public class → Java, fn → Rust
• Framework indicators: @app.route → Flask, useState → React, @Controller → Spring

Step 2 — Check for Vulnerabilities by Language

Python:

• Command injection: os.system(), subprocess with shell=True
• Unsafe deserialization: pickle.loads() on untrusted data
• Code execution: eval() / exec() with user-controlled input
• SQL injection via f-strings or % formatting in queries
• Path traversal in open() with user-supplied paths

JavaScript / TypeScript:

• XSS: innerHTML, document.write(), dangerouslySetInnerHTML without sanitization
• Prototype pollution via Object.assign / spread with user data
• eval() or new Function() with dynamic content
• Unvalidated postMessage handlers
• Sensitive data in localStorage or sessionStorage

React:

• dangerouslySetInnerHTML without DOMPurify or equivalent
• User input rendered directly in JSX without escaping
• Sensitive tokens/data stored in component state

Java:

• Statement instead of PreparedStatement for SQL
• Runtime.exec() with user-controlled input
• XXE vulnerabilities in XML parsers
• Unsafe deserialization (ObjectInputStream)

Go:

• SQL injection in raw database/sql queries
• Command injection in exec.Command with user input
• Path traversal in file serving handlers
• Race conditions in concurrent code without proper locking

SQL:

• String concatenation in queries instead of parameterized queries
• UPDATE/DELETE without WHERE clause
• SELECT * returning sensitive columns unnecessarily
• Overly permissive stored procedure privileges

Step 3 — Universal Security Checklist

Verify ALL of these, regardless of language:

Secrets & Credentials:

• [ ] No hardcoded passwords, API keys, tokens, or secrets anywhere in the code
• [ ] Credentials loaded from environment variables or a secrets manager
• [ ] No secrets in comments or test fixtures

Injection:

• [ ] No SQL queries built with string concatenation or f-strings
• [ ] No shell commands built from user input
• [ ] No dynamic code execution (eval, exec) with user data

Input Validation:

• [ ] All user input is validated before use
• [ ] File uploads validate type, size, and content (not just extension)
• [ ] No reliance on client-side validation alone

Authentication & Authorization:

• [ ] Passwords hashed with bcrypt, argon2, or scrypt (not MD5/SHA1/plain)
• [ ] Session tokens are randomly generated and rotated after login
• [ ] Access control checks present before every sensitive operation
• [ ] Ownership verified before returning or modifying resources (IDOR prevention)

Cryptography:

• [ ] No weak algorithms: MD5, SHA1, DES, RC4, ECB mode
• [ ] Cryptographic keys not hardcoded
• [ ] Secure random number generator used for tokens/nonces

Error Handling & Logging:

• [ ] No stack traces or internal details in responses
• [ ] Sensitive data (passwords, tokens, PII) not written to logs
• [ ] Errors handled gracefully

Data Exposure:

• [ ] Sensitive fields not returned in API responses unnecessarily
• [ ] Pagination/limits applied to list endpoints

Step 4 — Output

Produce this exact structure:

Security Code Review

File: [file path if known, or "provided code"] Language/Frameworks: [detected list] Risk Level: [LOW | MEDIUM | HIGH | CRITICAL]

Overall Assessment

[SECURE | NEEDS ATTENTION | INSECURE]

[1–2 sentences summarizing the security posture]

Findings

For each vulnerability found:

#### [SEVERITY: Critical/High/Medium/Low] — [Vulnerability Type] Location: [function name or line number if identifiable] Description: [what the vulnerability is and why it matters]

Vulnerable code:

[the problematic snippet]

Secure fix:

[the corrected code]

Checklist Results

• ✅ [Item that passes]
• ❌ [Item that fails — brief note]
• ⚠️ [Item that needs review — context-dependent]

Prioritized Recommendations

1. [CRITICAL/HIGH] — [Action to take]
2. ...