secure-code-review-pipeline

Plugin secure-code-review-pipeline from marketplace skillmd in skillmds/SkillMD. Commands read from the repo's manifest — 2 days ago.

Skills (12)

• production-python-ai

  Production-grade Python and AI engineering standards. Use for ANY Python work — FastAPI services, LangChain/LangGraph agents, RAG pipelines, LLM API integrations, document processing, or data scripts — whether writing new code, reviewing, refactoring, or debugging. Enforces typed Pydantic boundaries

• api-security

  Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.

• code-audit

  Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

• dotnet-reverse

  .NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 re

• find-bugs

  Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

• fix-review

  Verify fix commits address audit findings without new bugs

• identity-federation

  Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

• pr-review-expert

  Use when the user asks to review pull requests, analyze code changes, check for security issues in PRs, or assess code quality of diffs.

• security-and-hardening

  Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.

• security-audit

  Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard

• supply-chain-security

  Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.

• xxe

  XML External Entity (XXE) injection exploits XML parsers that process DTD external entity declarations, enabling local file disclosure (`file:///etc/passwd`), SSRF via `http://` entities, and DoS via Billion Laughs. Vulnerable Java APIs include `DocumentBuilder`, `SAXParser`, `dom4j`, `TransformerFa