More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsSaaS Backend Code Reviewer
Production-grade backend code reviews focusing on security, multi-tenancy, and data integrity for SaaS systems.
$8.99
SaaS Backend Code Reviewer
Example session with this skill installed
Review this Express.js endpoint for a multi-tenant SaaS. It handles organization-specific project updates: [pastes code with a missing tenant_id check in the update query].
- Read your context and instructions
- Compiled the saas backend code
Mode: Full Production Review
Summary: 1 Critical issue found. The endpoint lacks proper tenant isolation on the write path.
1 Critical, 0 High, 0 Medium, 1 Low.
Findings
CRITICAL — Cross-tenant data overwrite in updateProject
- Location:
projects.controller.jsline 42 - Confidence: Confirmed — the
db.updatecall useswhere: { id }but lacks anorg_idfilter.
Problem: A user from Org A can update a project belonging to Org B by guessing or brute-forcing the project UUID. In a multi-tenant SaaS, every query must be scoped to the authenticated tenant.
- Suggested Fix:
// Change this:
await db('projects').where({ id: req.params.id }).update(updateData);
// To this:
await db('projects')
.where({
id: req.params.id,
org_id: req.user.org_id // Scope to the authenticated user's organization
})
.update(updateData);
LOW — Missing Input Validation for updateData
- Location:
projects.controller.jsline 38 - Confidence: High —
req.bodyis passed directly to the database update without a schema check.
Problem: Potential mass assignment risk. If the projects table has internal fields like is_premium or plan_level, a malicious user could potentially update those via the request body.
Suggested Fix: Use a schema validator like Joi or Zod to allowlist only permitted fields (e.g., name, description).
Nitpicks
- Standardize HTTP 204 No Content for successful updates instead of 200 OK with an empty body.
What wasn't reviewed
- Observability: No logging middleware was shown in this snippet.
- Dependency risk: Version of
knex/pgis unknown.
Next steps
- Apply the
org_idfilter to the update query immediately. - Implement a validation schema for the request body.
- Verify that the GET and DELETE endpoints for this resource also enforce the
org_idfilter.
Connects securely to your tools. The creator never sees your data.
About this skill
SaaS backend code can hide serious production risks that are easy to miss during a conventional code review. Tenant data leaks, race conditions, broken idempotency, and architectural weaknesses can lead to security incidents, corrupted data, or unexpected outages.
This skill performs rigorous audits across eight dimensions, including security, multi-tenancy isolation, concurrency, data integrity, performance, API design, observability, and testing.
Each finding receives independent Severity and Confidence ratings, helping distinguish confirmed issues from suspicious patterns that require further investigation.
Choose focused review modes such as Security, Performance, or PR/Diff when you need targeted feedback without unnecessary noise.
The skill follows a strict "never fabricate" principle. Findings are tied to specific code whenever possible, and missing context is explicitly acknowledged instead of being presented as fact.
Unlike generic AI code reviews, it follows a disciplined engineering rubric designed to reduce false positives, avoid generic style nitpicks, and focus attention on issues that can actually affect a SaaS application in production.
Use cases
- Review a new API endpoint before merging it into production.
- Audit a multi-tenant data access layer for tenant isolation issues.
- Investigate potential race conditions or idempotency problems in webhook handlers.
- Perform security-focused reviews of authentication and token-handling logic.
- Evaluate backend changes in a pull request or code diff.
Known limitations
Infrastructure-level security controls such as WAF and IAM cannot be verified unless their configuration is explicitly provided. Specific package vulnerabilities or version-related issues also cannot be confirmed without the relevant dependency information.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for APIs & Backend.
Cannot verify infrastructure-level security (WAF, IAM) or specific package versions unless the user explicitly provides that configuration.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 2 months ago
Permissions
No special permissions declared or detected