Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsApplication Security Inspector — Pre-Release Review
Review authorized application code, architecture, dependencies, and configuration to prioritize evidence-backed security findings, safe validation, and developer-ready fixes before release.
$9.99
Application Security Inspector — Pre-Release Review
Example session with this skill installed
Review this fictional pre-release order API based only on these facts: users authenticate with short-lived bearer tokens; order endpoints accept an order ID; the team says “IDs are hard to guess” but has not supplied authorization code or tests; a CSV import accepts uploaded files; tenant context is added by middleware; dependencies and deployment config were not provided. No source code, scanner output, live target, or test environment is available. Create a scoped defensive review with assets/trust boundaries, evidence-status findings (do not claim vulnerabilities without proof), safe non-destructive validation steps, remediation guidance, regression tests, missing evidence, and a release-readiness decision. Do not provide attack payloads or attempt access to any live system.
- Read your context and instructions
- Compiled the application security inspector
Pre-Release Application Security Review — Order API
Scope and evidence: This is a design-level review of the fictional facts supplied. No source code, authorization middleware, dependency manifest, deployment configuration, scanner results, or test environment was provided. Findings below are
risks to verify, not confirmed vulnerabilities. No live system was tested.
Assets and trust boundaries
Assets: order records, tenant/customer data, bearer tokens, uploaded CSV contents, administrative or fulfillment actions.
Boundaries: authenticated user → API; request/order identifier → authorization decision; tenant context middleware → handlers/data layer; uploaded file → parser/import pipeline; application → dependencies and deployment environment (not supplied).
Primary review questions: Is ownership enforced server-side for every order operation? Can tenant context be omitted or confused in asynchronous/import paths? Are uploaded files constrained, parsed safely, and isolated?
Findings to verify
| ID | Status / confidence | Risk and evidence | Safe validation | Remediation direction |
|---|---|---|---|---|
| F-01 Object-level order authorization | Needs validation / medium confidence | Endpoints accept an order ID; the team relies on IDs being hard to guess. Unpredictable identifiers do not prove ownership checks exist. No authorization code or tests were supplied, so no IDOR is confirmed. | In an authorized isolated test fixture, create two users/tenants and verify that every read, update, cancel, export, and nested operation rejects access to the other party's order. Inspect handler/service/data-layer predicates. | Enforce server-side authorization at the authoritative boundary using authenticated principal and tenant ownership on every operation. Add negative cross-tenant tests; do not rely on identifier secrecy. |
| F-02 Tenant context propagation | Needs validation / low-to-medium confidence | Middleware reportedly adds tenant context, but coverage through imports, background jobs, caches, and database queries is unknown. No bypass is confirmed. | Trace tenant identity from authentication through handlers, persistence, queue jobs, exports, and logs. Test missing, malformed, and mismatched context in a non-production fixture. | Derive tenant context from verified identity, fail closed when absent, and enforce tenant predicates in the service/data layer. Include async and cache isolation tests. |
| F-03 CSV upload safety | Needs validation / medium confidence | An upload/import function exists; file limits, content validation, parser behavior, storage isolation, and formula handling were not described. No unsafe parser behavior is confirmed. | Review the authorized upload path and parser configuration. In an isolated fixture, test allowed/rejected file types, size/row limits, malformed rows, path/name handling, and whether exported spreadsheet cells are safely handled. Avoid production uploads. | Apply size and schema limits, parse with maintained safe libraries, treat cells as untrusted input, isolate storage, use generated filenames, constrain processing resources, and report row-level errors without leaking sensitive data. |
| F-04 Token and API controls | Unknown / low confidence | Short-lived bearer tokens are reported, but issuer/audience validation, scopes, revocation, transport, logging, rate controls, and error behavior are unknown. Token lifetime alone does not establish secure authentication or authorization. | Review token validation and lifecycle configuration; confirm secrets are redacted from logs; inspect per-operation authorization and abuse controls using tests, not a live target. | Validate signature, issuer, audience, expiry, and intended scope; use TLS, least privilege, safe error handling, secret redaction, and appropriate rate/abuse controls. Tailor requirements to the real architecture. |
Missing evidence and release gates
Request the relevant handlers and authorization tests, tenant middleware and data-layer queries, CSV parser/storage configuration, token validation settings, dependency lockfile, deployment/IaC configuration, security logging policy, and release threat model. Confirm the test scope and authorization before active testing. Review current dependency advisories from a verified source when manifests are available.
Release recommendation
Hold a security sign-off decision pending verification of F-01 through F-03 and review of token controls. This is not a conclusion that the product is vulnerable; it reflects missing evidence for material authorization and file-processing boundaries. Close or explicitly accept documented residual risks after safe tests and regression coverage. A clean checklist or scanner result alone would not prove the application secure.
Next steps: Provide the scoped source/configuration and a non-production test plan; then convert these hypotheses into evidence-backed findings and retest fixes.
Connects securely to your tools. The creator never sees your data.
About this skill
Application Security Inspector helps authorized engineering teams review applications, APIs, mobile and desktop clients, services, cloud configuration, dependencies, and CI/CD controls before release. It scopes assets, actors, trust boundaries, entry points, sensitive data, identity and tenant models, deployment context, and available evidence before inspecting relevant attack surfaces.
The review can cover authentication and sessions; object, function, field, and tenant authorization; input/output handling; injection; CSRF and SSRF; file uploads and path handling; unsafe deserialization; redirects; business logic and race conditions; API and GraphQL controls; webhooks and OAuth/OIDC; secrets and cryptography; privacy-aware logging; dependencies; build artifacts; infrastructure configuration; and release processes. It prioritizes findings using evidence, reachability, prerequisites, exploitability, affected assets, impact, and compensating controls—not severity labels alone.
Each finding should state status and confidence, affected boundary, evidence, impact reasoning, reproduction or safe validation steps, developer-ready remediation, regression tests, and residual risk. The agent separates verified findings from hypotheses and scanner output, recommends non-destructive checks, and can produce a threat model, prioritized backlog, security test plan, remediation checklist, and release decision with explicit unresolved conditions.
The review is defensive and requires authorization. It does not imply access to source, repositories, scanners, dependency databases, cloud accounts, or running systems unless they are actually available. It does not prove a system secure, guarantee detection, or replace a qualified penetration test or incident response. It will not guide unauthorized compromise, credential theft, malware, persistence, evasion, destructive exploitation, or abuse. Share only authorized materials and minimize secrets and personal data.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 10 days ago
- Passed all security checks, Safe to install