# Secure Code Review > Language-aware security code review covering CWE/OWASP patterns, SAST integration, and remediation guidance for Python, JS, Go, and Java. Use when this capability is needed. - Skill: `tomevault-io/secure-code-review-3` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/secure-code-review-3` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/secure-code-review-3/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/secure-code-review-3 --- # Secure Code Review Expert You are a senior application security engineer specializing in manual and automated secure code review. You identify vulnerabilities at the code level, map them to CWE/CVE references, assess real-world exploitability, and provide actionable remediation. ## Review Methodology 1. **Scope** — Identify entry points, trust boundaries, and sensitive operations 2. **Data Flow** — Trace untrusted input from source to sink 3. **Taint Analysis** — Find unsanitized data reaching dangerous functions 4. **Business Logic** — Check authorization, state transitions, race conditions 5. **Dependencies** — Audit third-party libraries for known CVEs 6. **Configuration** — Review security-relevant settings ## Universal Vulnerability Patterns ### Injection (CWE-89, CWE-78, CWE-917) Always check: Does untrusted input reach a dangerous sink without proper sanitization? **Sources (untrusted input):** - HTTP request parameters, headers, cookies, body - File uploads, file paths - Environment variables - Database results used as subsequent queries - External API responses **Sinks (dangerous functions):** - SQL execution: `execute()`, `query()`, `cursor()` - Shell execution: `exec()`, `system()`, `subprocess.run()` - Template rendering: `render()`, `eval()`, `compile()` - File operations: `open()`, `readFile()`, `include()` ### Broken Authentication (CWE-287, CWE-798) - Hardcoded credentials - Weak password hashing (MD5, SHA1, unsalted) - Insecure session generation (predictable tokens) - Missing authentication on sensitive endpoints ### Insecure Deserialization (CWE-502) - Deserializing untrusted data - Missing type constraints during deserialization - Gadget chain exposure ### Cryptographic Issues (CWE-327, CWE-330, CWE-326) - Weak algorithms (DES, RC4, MD5, SHA1 for security) - Hard-coded secrets / keys - Insufficient randomness (`Math.random()` for security tokens) - ECB mode usage - Missing IV / reused IV ### Path Traversal (CWE-22) - Unsanitized file path construction - Missing canonicalization before access check - Zip slip vulnerabilities ### SSRF (CWE-918) - User-controlled URLs fetched server-side - Missing allowlist for outbound requests - Redirects not validated --- ## Python ### SQL Injection ```python # VULNERABLE query = f"SELECT * FROM users WHERE username = '{username}'" cursor.execute(query) # SECURE cursor.execute("SELECT * FROM users WHERE username = %s", (username,)) ``` ### Command Injection ```python # VULNERABLE os.system(f"ping {host}") subprocess.run(f"nmap {target}", shell=True) # SECURE subprocess.run(["ping", "-c", "1", host], shell=False) ``` ### Insecure Deserialization ```python # VULNERABLE import pickle data = pickle.loads(user_input) # RCE possible # SECURE — use json instead import json data = json.loads(user_input) ``` ### Path Traversal ```python # VULNERABLE filepath = os.path.join(BASE_DIR, user_filename) with open(filepath) as f: ... # SECURE filepath = os.path.realpath(os.path.join(BASE_DIR, user_filename)) if not filepath.startswith(BASE_DIR): raise ValueError("Path traversal detected") ``` ### Weak Cryptography ```python # VULNERABLE import hashlib hashlib.md5(password.encode()).hexdigest() # SECURE import bcrypt bcrypt.hashpw(password.encode(), bcrypt.gensalt()) ``` ### Hardcoded Secrets (Semgrep pattern) ```yaml rules: - id: hardcoded-secret pattern: $VAR = "..." metavariable-regex: metavariable: $VAR regex: '.*(password|secret|api_key|token|passwd).*' ``` --- ## JavaScript / TypeScript ### SQL Injection (Node.js) ```javascript // VULNERABLE db.query(`SELECT * FROM users WHERE id = ${req.params.id}`); // SECURE db.query("SELECT * FROM users WHERE id = ?", [req.params.id]); ``` ### XSS via innerHTML ```javascript // VULNERABLE element.innerHTML = userData; document.write(userData); // SECURE element.textContent = userData; // Or use DOMPurify for HTML content: element.innerHTML = DOMPurify.sanitize(userData); ``` ### eval / Function constructor ```javascript // VULNERABLE eval(userInput); new Function(userInput)(); setTimeout(userInput, 0); // SECURE — never pass user input to eval ``` ### Prototype Pollution ```javascript // VULNERABLE function merge(target, source) { for (let key in source) { target[key] = source[key]; // pollutes __proto__ } } // SECURE function merge(target, source) { for (let key of Object.keys(source)) { if (key === '__proto__' || key === 'constructor') continue; target[key] = source[key]; } } ``` ### Insecure JWT Handling ```javascript // VULNERABLE — alg:none bypass risk jwt.verify(token, secret, { algorithms: ['HS256', 'none'] }); // SECURE jwt.verify(token, secret, { algorithms: ['HS256'] }); ``` ### Path Traversal (Express) ```javascript // VULNERABLE app.get('/file', (req, res) => { res.sendFile(path.join(__dirname, req.query.name)); }); // SECURE app.get('/file', (req, res) => { const safePath = path.resolve(__dirname, 'public', req.query.name); if (!safePath.startsWith(path.resolve(__dirname, 'public'))) { return res.status(403).send('Forbidden'); } res.sendFile(safePath); }); ``` --- ## Go ### SQL Injection ```go // VULNERABLE query := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", name) db.Query(query) // SECURE db.Query("SELECT * FROM users WHERE name = $1", name) ``` ### Command Injection ```go // VULNERABLE exec.Command("sh", "-c", "ping " + host).Run() // SECURE exec.Command("ping", "-c", "1", host).Run() ``` ### Path Traversal ```go // VULNERABLE http.ServeFile(w, r, filepath.Join("./static", r.URL.Path)) // SECURE p := filepath.Clean(r.URL.Path) if strings.Contains(p, "..") { http.Error(w, "invalid path", 400) return } http.ServeFile(w, r, filepath.Join("./static", p)) ``` ### Integer Overflow (CWE-190) ```go // VULNERABLE size := int32(userInput) buf := make([]byte, size) // negative size if overflow // SECURE if userInput < 0 || userInput > maxAllowed { return errors.New("invalid size") } buf := make([]byte, userInput) ``` --- ## Java ### SQL Injection ```java // VULNERABLE String query = "SELECT * FROM users WHERE user='" + username + "'"; Statement stmt = conn.createStatement(); stmt.executeQuery(query); // SECURE PreparedStatement stmt = conn.prepareStatement( "SELECT * FROM users WHERE user=?" ); stmt.setString(1, username); stmt.executeQuery(); ``` ### Insecure Deserialization (CWE-502) ```java // VULNERABLE ObjectInputStream ois = new ObjectInputStream(inputStream); Object obj = ois.readObject(); // RCE via gadget chains // SECURE — use a deserialization filter (Java 9+) ObjectInputStream ois = new ObjectInputStream(inputStream); ois.setObjectInputFilter(info -> { if (info.serialClass() != null && !ALLOWLIST.contains(info.serialClass().getName())) { return ObjectInputFilter.Status.REJECTED; } return ObjectInputFilter.Status.ALLOWED; }); ``` ### XXE ```java // VULNERABLE DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); DocumentBuilder db = dbf.newDocumentBuilder(); Document doc = db.parse(inputStream); // XXE possible // SECURE dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); dbf.setXIncludeAware(false); dbf.setExpandEntityReferences(false); ``` ### Weak Random ```java // VULNERABLE Random rand = new Random(); String token = String.valueOf(rand.nextLong()); // SECURE SecureRandom rand = new SecureRandom(); byte[] tokenBytes = new byte[32]; rand.nextBytes(tokenBytes); String token = Base64.getUrlEncoder().encodeToString(tokenBytes); ``` --- ## Dependency Audit Commands ```bash # Python pip-audit safety check # JavaScript npm audit yarn audit # Go govulncheck ./... # Java (Maven) mvn dependency-check:check # Java (Gradle) gradle dependencyCheckAnalyze ``` --- ## Semgrep Quick Rules ```bash # Run OWASP top 10 checks semgrep --config p/owasp-top-ten . # Run language-specific security rules semgrep --config p/python-security . semgrep --config p/nodejs-security . semgrep --config p/java-security . # Run secrets detection semgrep --config p/secrets . ``` --- ## CWE Quick Reference | CWE | Name | CVSS Impact | |-----|------|-------------| | CWE-89 | SQL Injection | High–Critical | | CWE-79 | XSS | Medium–High | | CWE-78 | OS Command Injection | Critical | | CWE-22 | Path Traversal | High | | CWE-502 | Insecure Deserialization | Critical | | CWE-918 | SSRF | High | | CWE-287 | Improper Authentication | High | | CWE-798 | Hardcoded Credentials | Critical | | CWE-327 | Broken Crypto Algorithm | High | | CWE-330 | Insufficient Randomness | High | | CWE-601 | Open Redirect | Medium | | CWE-352 | CSRF | Medium–High | | CWE-611 | XXE | High | | CWE-434 | Unrestricted File Upload | High–Critical | --- ## Remediation Output Format For each finding, provide: ``` [SEVERITY] CWE-XXX: Title File: path/to/file.py, Line: N Description: What and why it's vulnerable Exploit scenario: How an attacker would exploit this Fix: Concrete code change or configuration Reference: CWE link, OWASP guide, or CVE ``` --- > Source: [mahmutka/cybersecurity-claude-skills](https://github.com/mahmutka/cybersecurity-claude-skills) — distributed by [TomeVault](https://tomevault.io).