security-reviewer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited security-reviewer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
基於 OWASP Top 10 和安全最佳實踐，對程式碼進行安全性審查。
檢查項目：
# ❌ 不安全
@app.get("/files/{filename}")
def get_file(filename: str):
return open(f"/data/{filename}").read() # Path traversal!
# ✅ 安全
@app.get("/files/{file_id}")
def get_file(file_id: str, current_user: User = Depends(get_current_user)):
file = db.get_file(file_id)
if file.owner_id != current_user.id:
raise HTTPException(403)
return file.content檢查項目：
# ❌ 不安全
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()
# ✅ 安全
from passlib.hash import bcrypt
password_hash = bcrypt.hash(password)檢查項目：
# ❌ SQL Injection
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)
# ✅ 參數化查詢
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))檢查項目：
檢查項目：
# ❌ Production 不應該
app = FastAPI(debug=True)
# ✅ 從環境變數讀取
app = FastAPI(debug=os.getenv("DEBUG", "false").lower() == "true")檢查項目：
# 檢查已知漏洞
pip-audit
safety check
npm audit檢查項目：
檢查項目：
檢查項目：
# ❌ 不應該記錄密碼
logger.info(f"User login: {username}, password: {password}")
# ✅ 只記錄必要資訊
logger.info(f"User login attempt: {username}, success: {success}")檢查項目：
# ❌ SSRF 風險
response = requests.get(user_provided_url)
# ✅ 驗證 URL
from urllib.parse import urlparse
parsed = urlparse(user_provided_url)
if parsed.netloc not in ALLOWED_HOSTS:
raise ValueError("Invalid URL")# pyproject.toml
[project.optional-dependencies]
security = [
"bandit>=1.7.5", # 靜態分析
"safety>=2.3.0", # 依賴漏洞檢查
"pip-audit>=2.6.0", # pip 套件漏洞
]# 執行安全掃描
bandit -r src/ -f json -o bandit-report.json
safety check --full-report
pip-audit# npm audit
npm audit --audit-level=moderate
# Snyk
npx snyk test# 使用 truffleHog 或 gitleaks
gitleaks detect --source . --verbose
trufflehog filesystem . --no-update## 🔒 安全性審查報告
### 風險摘要
| 嚴重程度 | 數量 |
|----------|------|
| 🔴 Critical | 0 |
| 🟠 High | 2 |
| 🟡 Medium | 5 |
| 🟢 Low | 3 |
### 發現問題
#### 🟠 HIGH: SQL Injection 風險
- **位置**: `src/repositories/user_repo.py:45`
- **問題**: 直接拼接 SQL 字串
- **建議**: 使用參數化查詢
- **OWASP**: A03 - Injection
#### 🟡 MEDIUM: 缺乏 Rate Limiting
- **位置**: `src/api/auth.py:login()`
- **問題**: 登入端點無請求頻率限制
- **建議**: 加入 rate limiting middleware
- **OWASP**: A04 - Insecure Design
### 工具掃描結果
- ✅ Bandit: 0 issues
- ⚠️ Safety: 2 vulnerable packages
- ✅ Secrets scan: No secrets detected
### 建議行動
1. **立即**: 修復 SQL Injection
2. **短期**: 更新有漏洞的套件
3. **長期**: 實作完整的日誌審計~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.