# Srajangpt1 AI Security Crew Verify Code

> Perform a security review of the following code:

- Skill: `tomevault-io/srajangpt1-ai-security-crew-verify-code` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/srajangpt1-ai-security-crew-verify-code`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/srajangpt1-ai-security-crew-verify-code/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/srajangpt1-ai-security-crew-verify-code

---


Perform a security review of the following code:

$ARGUMENTS

---

## What to do

Review the code provided in the arguments above. If no code was provided, ask the user to paste the code or specify a file path to read. If a file path is mentioned, read the file first.

### Step 1 — Detect Technologies

Identify language and frameworks from:
- File extension: `.py` → Python, `.ts/.tsx` → TypeScript, `.go` → Go, `.java` → Java, `.rb` → Ruby, `.php` → PHP, `.sql` → SQL
- Import statements: `import django`, `require('express')`, `import React`, `use actix_web`
- Syntax patterns: `def`/`class` → Python, `func` → Go, `public class` → Java, `fn ` → Rust
- Framework indicators: `@app.route` → Flask, `useState` → React, `@Controller` → Spring

### Step 2 — Check for Vulnerabilities by Language

**Python:**
- Command injection: `os.system()`, `subprocess` with `shell=True`
- Unsafe deserialization: `pickle.loads()` on untrusted data
- Code execution: `eval()` / `exec()` with user-controlled input
- SQL injection via f-strings or `%` formatting in queries
- Path traversal in `open()` with user-supplied paths

**JavaScript / TypeScript:**
- XSS: `innerHTML`, `document.write()`, `dangerouslySetInnerHTML` without sanitization
- Prototype pollution via `Object.assign` / spread with user data
- `eval()` or `new Function()` with dynamic content
- Unvalidated `postMessage` handlers
- Sensitive data in `localStorage` or `sessionStorage`

**React:**
- `dangerouslySetInnerHTML` without DOMPurify or equivalent
- User input rendered directly in JSX without escaping
- Sensitive tokens/data stored in component state

**Java:**
- `Statement` instead of `PreparedStatement` for SQL
- `Runtime.exec()` with user-controlled input
- XXE vulnerabilities in XML parsers
- Unsafe deserialization (`ObjectInputStream`)

**Go:**
- SQL injection in raw `database/sql` queries
- Command injection in `exec.Command` with user input
- Path traversal in file serving handlers
- Race conditions in concurrent code without proper locking

**SQL:**
- String concatenation in queries instead of parameterized queries
- `UPDATE`/`DELETE` without `WHERE` clause
- `SELECT *` returning sensitive columns unnecessarily
- Overly permissive stored procedure privileges

### Step 3 — Universal Security Checklist

Verify ALL of these, regardless of language:

**Secrets & Credentials:**
- [ ] No hardcoded passwords, API keys, tokens, or secrets anywhere in the code
- [ ] Credentials loaded from environment variables or a secrets manager
- [ ] No secrets in comments or test fixtures

**Injection:**
- [ ] No SQL queries built with string concatenation or f-strings
- [ ] No shell commands built from user input
- [ ] No dynamic code execution (`eval`, `exec`) with user data

**Input Validation:**
- [ ] All user input is validated before use
- [ ] File uploads validate type, size, and content (not just extension)
- [ ] No reliance on client-side validation alone

**Authentication & Authorization:**
- [ ] Passwords hashed with bcrypt, argon2, or scrypt (not MD5/SHA1/plain)
- [ ] Session tokens are randomly generated and rotated after login
- [ ] Access control checks present before every sensitive operation
- [ ] Ownership verified before returning or modifying resources (IDOR prevention)

**Cryptography:**
- [ ] No weak algorithms: MD5, SHA1, DES, RC4, ECB mode
- [ ] Cryptographic keys not hardcoded
- [ ] Secure random number generator used for tokens/nonces

**Error Handling & Logging:**
- [ ] No stack traces or internal details in responses
- [ ] Sensitive data (passwords, tokens, PII) not written to logs
- [ ] Errors handled gracefully

**Data Exposure:**
- [ ] Sensitive fields not returned in API responses unnecessarily
- [ ] Pagination/limits applied to list endpoints

### Step 4 — Output

Produce this exact structure:

---

## Security Code Review

**File:** [file path if known, or "provided code"]
**Language/Frameworks:** [detected list]
**Risk Level:** [LOW | MEDIUM | HIGH | CRITICAL]

### Overall Assessment
**[SECURE | NEEDS ATTENTION | INSECURE]**

[1–2 sentences summarizing the security posture]

### Findings

For each vulnerability found:

#### [SEVERITY: Critical/High/Medium/Low] — [Vulnerability Type]
**Location:** [function name or line number if identifiable]
**Description:** [what the vulnerability is and why it matters]

**Vulnerable code:**
```[language]
[the problematic snippet]
```

**Secure fix:**
```[language]
[the corrected code]
```

---

### Checklist Results
- ✅ [Item that passes]
- ❌ [Item that fails — brief note]
- ⚠️ [Item that needs review — context-dependent]

### Prioritized Recommendations
1. **[CRITICAL/HIGH]** — [Action to take]
2. ...

---
> Source: [Srajangpt1/ai-security-crew](https://github.com/Srajangpt1/ai-security-crew) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 -->