[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXGQ1DKT3638Q26FG216PE":3,"skill-same:01M6GXGQ1DKT3638Q26FG216PE":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":53,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6GXGQ1DKT3638Q26FG216PE","Security Review",null,"OWASP Top 10 checklist for code review. Covers injection, broken auth, XSS, insecure deserialization, SSRF, and dependency vulnerabilities.","malayvuong\u002Fagent-orchestra","malayvuong","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13240975?v=4","01M6GXCDVPB2VPZMDZK1KF98M0","Nguyen Minh Vuong","01M6GXCE176VDX3XV4Z4KNR33J",1,"MIT","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"review","security","security review","top","code review","checklist","dependency","broken","xss","deserialization","injection","owasp","ssrf","code","owasp top 10","auth","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: Security Review\ndescription: OWASP Top 10 checklist for code review. Covers injection, broken auth, XSS, insecure deserialization, SSRF, and dependency vulnerabilities.\nversion: 2026.3.1\nlicense: MIT\ntriggers:\n  lenses:\n    - security\n---\n\nWhen reviewing code from a security perspective, apply the following OWASP Top 10 checks systematically.\n\n## Injection (A03)\n\nCheck all locations where user-supplied data reaches a command interpreter or query engine. Look for SQL, NoSQL, OS command, LDAP, and XPath injection. Flag any string concatenation used to build queries or commands. Verify parameterized queries or prepared statements are used consistently. Check ORM usage for raw query escape hatches.\n\n## Broken Authentication (A07)\n\nReview session token generation for cryptographic strength. Verify passwords are hashed with bcrypt, scrypt, or Argon2 — never MD5 or SHA-1. Check for hard-coded credentials, API keys, or secrets in source files. Confirm multi-factor authentication paths cannot be bypassed. Verify session expiry is enforced server-side.\n\n## Cross-Site Scripting (XSS) (A03)\n\nIdentify all locations where user input is reflected into HTML, JavaScript, or CSS. Confirm output encoding is applied before rendering. Flag uses of `innerHTML`, `dangerouslySetInnerHTML`, `document.write`, or `eval` with external data. Check Content-Security-Policy headers are set appropriately.\n\n## Insecure Deserialization (A08)\n\nFlag any deserialization of data from untrusted sources (JSON.parse with no schema validation, pickle, Java ObjectInputStream, YAML.load with unsafe loader). Verify type and schema validation occurs before object construction. Check that deserialized data cannot trigger remote code execution through magic methods or gadget chains.\n\n## Server-Side Request Forgery (SSRF) (A10)\n\nIdentify code that makes HTTP requests based on user-supplied URLs or hostnames. Verify allowlists are used rather than denylists. Check that internal metadata endpoints (169.254.169.254, localhost, 10.x, 172.16.x) are blocked. Flag any URL redirect chains that could be exploited.\n\n## Vulnerable Dependencies (A06)\n\nNote any direct use of third-party libraries with known CVEs. Flag outdated dependency versions. Verify `package-lock.json` or `pnpm-lock.yaml` is committed to prevent supply-chain substitution. Check that development dependencies cannot be loaded in production paths.\n\n## Additional Checks\n\n- Sensitive data exposure: verify PII, tokens, and credentials are not logged or returned in error responses.\n- Security misconfiguration: check CORS policies, HTTP security headers, and default credentials.\n- Broken access control: verify authorization checks occur on every sensitive operation, not just at the UI layer.\n\nFor each finding, report: the file and line range, the OWASP category, the specific risk, and a remediation recommendation.\n","When reviewing code from a security perspective, apply the following OWASP Top 10 checks systematically.\n\n## Injection (A03)\n\nCheck all locations where user-supplied data reaches a command interpreter or query engine. Look for SQL, NoSQL, OS command, LDAP, and XPath injection. Flag any string concatenation used to build queries or commands. Verify parameterized queries or prepared statements are used consistently. Check ORM usage for raw query escape hatches.\n\n## Broken Authentication (A07)\n\nReview session token generation for cryptographic strength. Verify passwords are hashed with bcrypt, scrypt, or Argon2 — never MD5 or SHA-1. Check for hard-coded credentials, API keys, or secrets in source files. Confirm multi-factor authentication paths cannot be bypassed. Verify session expiry is enforced server-side.\n\n## Cross-Site Scripting (XSS) (A03)\n\nIdentify all locations where user input is reflected into HTML, JavaScript, or CSS. Confirm output encoding is applied before rendering. Flag uses of `innerHTML`, `dangerouslySetInnerHTML`, `document.write`, or `eval` with external data. Check Content-Security-Policy headers are set appropriately.\n\n## Insecure Deserialization (A08)\n\nFlag any deserialization of data from untrusted sources (JSON.parse with no schema validation, pickle, Java ObjectInputStream, YAML.load with unsafe loader). Verify type and schema validation occurs before object construction. Check that deserialized data cannot trigger remote code execution through magic methods or gadget chains.\n\n## Server-Side Request Forgery (SSRF) (A10)\n\nIdentify code that makes HTTP requests based on user-supplied URLs or hostnames. Verify allowlists are used rather than denylists. Check that internal metadata endpoints (169.254.169.254, localhost, 10.x, 172.16.x) are blocked. Flag any URL redirect chains that could be exploited.\n\n## Vulnerable Dependencies (A06)\n\nNote any direct use of third-party libraries with known CVEs. Flag outdated dependency versions. Verify `package-lock.json` or `pnpm-lock.yaml` is committed to prevent supply-chain substitution. Check that development dependencies cannot be loaded in production paths.\n\n## Additional Checks\n\n- Sensitive data exposure: verify PII, tokens, and credentials are not logged or returned in error responses.\n- Security misconfiguration: check CORS policies, HTTP security headers, and default credentials.\n- Broken access control: verify authorization checks occur on every sensitive operation, not just at the UI layer.\n\nFor each finding, report: the file and line range, the OWASP category, the specific risk, and a remediation recommendation.\n",{"name":5,"license":15,"version":46,"triggers":47,"description":7},"2026.3.1",{"lenses":48},[25],"main","eac6069a8690d89fd23f08d2d14e4874ed376a77",".agent-orchestra\u002Fskills\u002Fsecurity-review",0,"https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra","https:\u002F\u002Fgithub.com\u002Fmalayvuong","www.malayvuong.com","Just a newbie at everything","2026-10-09 12:52:45",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add malayvuong\u002Fagent-orchestra --skill \"Security Review\"",{"tool":64,"command":65},"bunx","bunx skills add malayvuong\u002Fagent-orchestra --skill \"Security Review\"",{"tool":67,"command":68},"pnpm","pnpm dlx skills add malayvuong\u002Fagent-orchestra --skill \"Security Review\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fsecurity-review\u002FSKILL.md",true,[],[73,113,132,150,171,190],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":93,"publishedAt":41},"01M6GXHYPRJ43SHFPFJTF87GS8","Vue.js Review","Deep review of Vue.js applications — Composition API patterns, reactivity traps, component design, Pinia state management, and performance pitfalls.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fvue-review\u002FSKILL.md",[79,82,85,88],{"categoryNo":80,"categoryName":81,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":86,"categoryName":87,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":89,"categoryName":90,"taxonomyType":91,"taxonomyTypeDesc":92},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[24,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112],"vue","js","Vue js Review","design","performance","component","state management","state","deep review","api patterns","applications","api","Composition","pinia","management","deep","logic","pitfalls","pinia state",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":41},"01M6GXHSPDDH1PQEN61ENMCEF5","Unity Review","Deep review of Unity C# code — object pooling, Update allocation, physics patterns, UI performance, serialization, and mobile optimization.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Funity-review\u002FSKILL.md",[],[24,120,115,98,121,37,102,122,123,124,125,126,127,109,110,128,129,130,131],"unity","update","ui","serialization","Optimization","mobile","patterns","physics","C#","mobile optimization","object","allocation",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":41},"01M6GXHNKTH12CGSRWDGF2H1Q9","TypeScript Review","Deep review of TypeScript code — type safety, generics patterns, strict mode compliance, type narrowing, module boundaries, and common escape hatches.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftypescript-review\u002FSKILL.md",[],[24,139,140,37,102,141,142,143,144,126,109,110,145,146,147,148,149],"typescript","typescript review","compliance","Type Safety","Safety","common","module","type","interface","consistency","mode",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":160,"publishedAt":41},"01M6GXHH3DMZD272RVH4800C67","Test Conventions","Testing patterns and conventions for code review. Covers naming, AAA structure, boundary testing, mock vs real dependencies, and coverage expectations.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftest-conventions\u002FSKILL.md",[156,157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[161,162,152,28,163,24,37,164,165,166,126,167,168,169,170],"test","conventions","testing","testing patterns","boundary","coverage","dependencies","structure","mock","naming",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":41},"01M6GXHCAQSJDVNVRFFD1HJWTN","Terraform Review","Deep review of Terraform\u002FOpenTofu configuration — state management, module design, security hardening, drift prevention, and production safety patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fterraform-review\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":86,"categoryName":87,"taxonomyType":21,"taxonomyTypeDesc":22},[24,182,173,97,25,100,101,102,183,184,185,186,143,187,108,188,189,109,110,145],"terraform","cloud","aws","hardening","Production","opentofu","iac","drift",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":41},"01M6GXH83F11CK4BQEAJPN6HDE","Swift Review","Deep review of Swift code — memory management, concurrency patterns, optionals, protocol design, SwiftUI lifecycle, and iOS platform patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fswift-review\u002FSKILL.md",[196],{"categoryNo":86,"categoryName":87,"taxonomyType":21,"taxonomyTypeDesc":22},[198,24,192,97,199,98,37,200,102,201,202,203,204,205,108,109,110,206,207,208],"swift","memory","protocol","ios","concurrency","lifecycle","swiftui","uikit","xcode","apple","platform"]