More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsSecure Code Review Pro
Security review for your code. Finds injection, broken auth, access control flaws, leaked secrets and risky dependencies, then delivers a scored report with copy-paste secure fixes.
$12
secure-code-review-pro
Example session with this skill installed
Review this Python Flask login function for security issues:
@app.route('/login', methods=['POST'])
def login():
user = db.execute("SELECT * FROM users WHERE username = '" + request.form['user'] + "'").fetchone()
return "Welcome" if user else "Fail"
- Read your context and instructions
- Compiled the secure-code-review-pro
The review of the provided Flask login snippet is complete. I have identified a critical SQL injection vulnerability and missing authentication best practices.
Secure Code Review Report
1. Scope
Reviewed a single Python Flask route for user authentication. Assumes db is a standard SQL database connector.
2. Summary
Security Score: 20/100
Findings: 1 Critical, 1 High, 1 Medium
- Top Risk: Remote attackers can bypass authentication and dump the database via SQL injection.
- Second Risk: The application is vulnerable to brute-force attacks due to lack of rate limiting.
- Third Risk: Success/Failure feedback is overly simplistic and may lack session management.
3. Findings
[CRITICAL] SQL Injection (Confirmed)
- Location:
login()function,db.executeline. - Category: Injection (OWASP A03), CWE-89.
- Problem: User input from
request.form['user']is concatenated directly into the SQL string.
Impact: An attacker can provide a payload like ' OR '1'='1 to log in as any user or use UNION statements to steal data.
- Secure code:
@app.route('/login', methods=['POST'])
def login():
# Use parameterized queries to prevent injection
query = "SELECT * FROM users WHERE username = %s"
user = db.execute(query, (request.form['user'],)).fetchone()
if user and verify_password(request.form['pass'], user['password']):
session['user_id'] = user['id']
return redirect(url_for('dashboard'))
return "Invalid credentials", 401
Test: Submit ' OR 1=1 -- in the username field. A secure fix will return a 401 Unauthorized instead of logging in.
[HIGH] Missing Password Verification (Confirmed)
- Location:
login()return logic. - Category: Broken Authentication (OWASP A07).
- Problem: The code only checks if the user exists, not if a password matches.
- Fix: Implement
argon2-cffifor secure password hashing and verification.
Next steps
- Implement parameterized queries immediately across all database interactions.
- Add a robust password hashing library like
argon2. - Configure secure session cookies with
HttpOnlyandSecureflags.
Connects securely to your tools. The creator never sees your data.
About this skill
Most security problems are not found by hackers first. They are found by developers who checked their code in time.
Secure Code Review Pro turns Claude into a senior application security engineer who reviews your code the way a professional AppSec consultant would, and gives you a clear, prioritized list of what to fix.
WHAT IT CHECKS
- Injection: SQL, NoSQL, OS command, template, path traversal
- Authentication: password storage, login protection, sessions, JWT, password reset
- Access control: missing permission checks, IDOR, mass assignment
- XSS and unsafe output handling
- Secrets and configuration: hard-coded keys, debug mode, CORS, cookies, headers
- Cryptography and data protection
- SSRF, CSRF, unsafe deserialization, unrestricted file uploads, XXE
- Dependencies and supply chain risks
- Business logic abuse, race conditions, missing rate limits, unverified webhooks
- Logging and monitoring gaps
WHAT YOU GET
- A short scope summary of what was reviewed
- A Security Score from 0 to 100
- Findings ranked CRITICAL / HIGH / MEDIUM / LOW, each with location, category (OWASP/CWE), plain-language impact, a fix, ready-to-paste secure code and a test that proves the fix works
- Confidence tags (Confirmed / Likely / Needs check) so nothing is guessed
- Positive observations, a fix plan and hardening recommendations
WHO IT IS FOR
- Developers and indie hackers shipping web apps, APIs, SaaS and Telegram/Discord bots
- Agencies and freelancers who want to deliver safer code to clients
- Founders preparing for launch or a customer security questionnaire
- Teams that want a fast second opinion before a pull request is merged
HOW TO USE Install the skill and say: "Review this code for security" and paste your code, a file, a diff or describe a feature like login or file upload. The skill asks up to 3 short questions if context is missing, then continues.
DEFENSIVE BY DESIGN This skill finds and fixes weaknesses. It does not write exploits, attack tools or malware.
HONEST LIMITS This is an expert review of the material you provide, not a penetration test or a guarantee that no vulnerabilities remain. For high-risk systems (payments, health data, large user bases), combine it with a professional penetration test.
Works with Python, JavaScript/TypeScript, PHP, Java, Go, C# and more. Fixes match the framework you already use.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 8 days ago
- Passed all security checks, Safe to install