A comprehensive security auditing skill that identifies injection vulnerabilities, authorization bypasses, and reliability anti-patterns in source code.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install bookforge-secure-code-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install bookforge-secure-code-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Secure Code Review?
The Secure Code Review skill provides a systematic framework for auditing codebases against the most common and damaging security vulnerabilities. It focuses on identifying injection attacks, Cross-Site Scripting (XSS), and authorization logic errors that often arise from complex nesting or improper framework usage. By leveraging Openclaw Skills, developers can transition from reactive patching to a proactive, hardened-by-construction design approach.
This skill doesn't just find bugs; it enforces a philosophy where security invariants are made impossible to violate through type-safety and centralized interceptors. It is particularly effective for evaluating whether a system uses strong types like SafeHtml or TrustedSqlString to prevent user-controlled input from reaching sensitive sinks. By integrating this into your development lifecycle, you ensure that security and reliability are treated as core architectural requirements.
Secure Code Review Use Cases
- Conducting a systematic security audit before a major service launch.
- Reviewing pull requests that modify database query construction or HTML rendering logic.
- Auditing legacy codebases for primitive type obsession that might lead to security misuse.
- Identifying authorization bypass risks in deeply nested conditional logic.
- Assessing whether RPC backends correctly utilize centralized interceptor frameworks for authentication and logging.
How Secure Code Review Works
- Define the scope by identifying the programming language, framework entry points, and data access patterns.
- Execute automated scans for SQL injection risks by detecting raw string concatenation in database queries.
- Analyze HTML rendering paths to identify potential XSS exposure and missing type-safe wrappers.
- Evaluate conditional nesting depth to find potential authorization bypasses and logic errors.
- Audit function signatures for primitive type usage in security-sensitive contexts.
- Inspect RPC backend registration to ensure cross-cutting concerns like rate-limiting and auth are handled by the framework.
- Generate a prioritized security findings report with severity levels and concrete fix recommendations.
Secure Code Review Setup
To get started with this skill within the Openclaw Skills ecosystem, ensure your environment has access to standard CLI tools like grep.
# Navigate to your project directory
cd /path/to/your/repository
# The skill utilizes grep for pattern matching and read for context analysis
# Ensure the secure-code-review skill is loaded in your AI agent profile
Secure Code Review Data Schema & Taxonomy
The skill generates a structured security findings report organized by severity. Each finding includes the following metadata:
| Attribute | Description |
|---|---|
| Severity | Classification (Critical, High, Medium, Low) based on impact. |
| Anti-Pattern Class | The specific security or reliability failure detected (e.g., SQLi, XSS). |
| Affected Location | The specific file and line number(s) where the pattern was found. |
| Fix Recommendation | Concrete code examples demonstrating how to harden the implementation. |
| Positive Patterns | Identification of existing hardened structures like interceptors or typed builders. |
Secure Code Review Advanced Features
- Pattern-based detection for language-specific injection signatures (Python f-strings, Java/Go concatenation).
- Heuristic analysis of indentation levels to flag high-risk authorization nesting.
- Type-system validation for security wrappers such as SafeHtml, SafeUrl, and TrustedResourceUrl.
- Support for identifying YAGNI complexity that increases the system's attack surface.
- Integration with RPC interceptor logic to verify execution order of logging, authentication, and authorization.
SKILL.md
Loading
Related Openclaw Skills
Secure Deployment Pipeline
A comprehensive framework for securing software delivery pipelines against insider threats and external supply chain attacks using binary provenance.
Text Repeater
A comprehensive text manipulation utility for repetition, Unicode styling, invisible character generation, and data cleanup.
OpenClaw Creator Setup
A comprehensive configuration utility designed to help content creators and self-media professionals initialize, manage, and optimize their AI-driven workflow environments.
Security Change Rollout Planning
A comprehensive framework for classifying, triaging, and executing security-critical changes across system fleets with minimized downtime and maximum reliability.
Resilience and Blast Radius Design
A technical framework for designing and auditing system resilience through layered defense, compartmentalization, and failure domain mapping.
KLM Brand Insights
An intelligence skill for analyzing the KLM brand's market position, product ecosystem, and global reach.
Featured*
