thkt/use-context-reviewer-security

Security Review

Detection (OWASP Top 10)

LLM01 covers apps that pass untrusted content to an LLM. The sink is the prompt itself: untrusted text concatenated without a data/instruction boundary, or a caller-supplied value interpolated into a system prompt. Constrain an LLM tool such as fetch_url the same way as its non-LLM counterpart, A10 SSRF. The tool is the sink, not the prompt.

| ID | Category | Pattern | Fix | | ----- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | A01 | Broken Access Control | Missing auth, IDOR, path traversal | Auth middleware, ownership check | | A02 | Cryptographic Failures | password: 'plaintext' | bcrypt/argon2 hashing | | A03 | Injection | db.query(\SELECT...${id}`) | Parameterized query, ORM | | A03 | Injection |exec(`ping ${host}`) | Input validation, library instead | | A03 | XSS |dangerouslySetInnerHTML(static presence) | Default escaping, DOMPurify | | A05 | Security Misconfiguration |cors({ origin: '*' }) | Explicit origin allowlist | | A05 | Security Misconfiguration |cookie: {}with no options | secure, httpOnly, sameSite: 'strict' | | A05 | Security Misconfiguration |err.stackin error response withoutNODE_ENVguard | Generic message in prod, log internally | | A09 | Logging Failures |logger.info({ password }) | Exclude sensitive fields | | A10 | SSRF |fetch(userInputUrl) | URL validation, allowlist | | A07 | Authentication Failures | No rate limit on auth endpoints (login, register, password-reset) | Rate limiter middleware on auth route group | | A01 | CSRF | No CSRF token verification on state-changing requests (POST/PUT/PATCH/DELETE) | Double Submit Cookie | | A02 | Timing Attack |===comparison of tokens/signatures | Constant-time comparison: XOR all bytes, decide last | | A08 | Prototype Pollution | Request object built with...bodyspread | Explicit field assignment | | A03 | XSS (Taint) |dangerouslySetInnerHTML={{ __html }}without sanitizer | DOMPurify.sanitize() at boundary | | A03 | XSS (Taint) | Function arg →innerHTMLwithout sanitization | Sanitize at function boundary | | A03 | XSS (Taint) |<a href={variable}>with user-controlled URL | Protocol allowlist of https/http only | | A01 | Open Redirect (Taint) | URL param →location.hrefwithout validation | Domain allowlist or relative-only | | A04 | Insecure Design |postMessagehandler without origin check | Strictevent.origin` comparison | | A02 | Sensitive Data Exposure | JWT stored in localStorage/sessionStorage | httpOnly cookie instead | | LLM01 | Prompt Injection (LLM) | Untrusted or caller-controlled value such as RAG docs, fetched content, tool results, or role args reaches the prompt with no data-only framing | Delimit untrusted content as data; map caller values to fixed enumerated instructions |

Reporting

The severity scale is critical / high / medium. Always include file:line. Report each independent vulnerability as its own finding. When one file holds two distinct issues (e.g. a path traversal and a separate prompt injection), list both as separate findings rather than folding one into a note on the other.

| Signal | Severity | Required output | | ------------------- | -------- | ------------------------------------ | | Certain exploit | critical | Full exploit scenario + concrete fix | | Clear vulnerability | high | Attack vector + concrete fix | | Possible issue | medium | verification_hint + suggested fix | | Speculative only | none | Do NOT report |

References

| Topic | Scope | File | | --------- | ---------------- | ---------------------------------------------------------- | | Basic | A01, A02, A07 | ${CLAUDE_SKILL_DIR}/references/owasp-basic.md | | Injection | A03 | ${CLAUDE_SKILL_DIR}/references/owasp-injection.md | | Advanced | A04-A06, A08-A10 | ${CLAUDE_SKILL_DIR}/references/owasp-advanced.md | | Cloud | IAM, IaC, CI/CD | ${CLAUDE_SKILL_DIR}/references/cloud-infrastructure.md | | Frontend | Taint analysis | ${CLAUDE_SKILL_DIR}/references/frontend-taint-checklist.md |