ReddRadar
Agent skill
secure-code-review
Use this skill when reviewing or writing code that handles user input, authentication, file I/O, network requests, or database queries. Always check for common security vulnerabilities before considering the code complete.
Install this agent skill to your Project
npx add-skill https://github.com/aiming-lab/MetaClaw/tree/main/memory_data/skills/secure-code-review
SKILL.md
Secure Code Review Checklist
Input Validation:
- Never trust user-supplied input; validate type, length, and format at boundaries.
- Use parameterized queries — never string-interpolate SQL.
- Sanitize before rendering HTML to prevent XSS.
Secrets & Credentials:
- No hardcoded passwords, API keys, or tokens in source code.
- Use environment variables or a secrets manager.
- Check
.gitignorebefore adding any config files.
Dependencies:
- Pin dependency versions; audit with
pip auditornpm audit. - Minimize surface area: remove unused packages.
Auth:
- Verify authorization on every protected endpoint, not just at login.
- Use short-lived tokens; implement refresh flows.
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
aiming-lab/MetaClaw
structured-progress-update
Use this skill when summarizing progress on an ongoing project or multi-step task. Give a clear, scannable status report whenever asked for an update or at the end of a work session.
aiming-lab/MetaClaw
async-communication-etiquette
Use this skill when writing messages in async channels (Slack, GitHub issues, email threads) where the reader may not have context and cannot ask follow-up questions immediately.
aiming-lab/MetaClaw
idempotent-script-design
Use this skill when writing scripts, cron jobs, data pipelines, or any automated process that may be run multiple times. Design every operation to be safely re-runnable without side effects.
aiming-lab/MetaClaw
secrets-management
Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.
aiming-lab/MetaClaw
input-validation-and-sanitization
Use this skill when implementing any endpoint, form handler, CLI tool, or function that accepts external input. Validate and sanitize all untrusted data before processing — never assume input is safe.
aiming-lab/MetaClaw
graceful-error-recovery
Use this skill when a tool call, command, or API request fails. Diagnose the root cause systematically before retrying or changing approach. Do not retry the same failing call without first understanding why it failed.
Didn't find tool you were looking for?