From rails-agent-skills
Performs security audits on Ruby on Rails code for auth, authorization, params, redirects, XSS, CSRF, SSRF, SQL injection, file uploads, and secrets.
npx claudepluginhub igmarin/rails-agent-skills --plugin rails-agent-skillsThis skill uses the workspace's default tool permissions.
Use this skill when the task is to review or harden Rails code from a security perspective.
Audits code for OWASP Top 10 vulnerabilities, auth implementations, CORS/CSRF/XSS protections, security headers, dependency risks, and clean code practices like DRY/SOLID. Use before deploy.
Audits web applications and REST APIs for OWASP Top 10 vulnerabilities including broken access control, authentication failures, data protection, and configuration issues. Use when reviewing code, auth/authz, APIs, or before deployment.
Audits web applications and REST APIs for OWASP Top 10 vulnerabilities including broken access control, authentication failures, and data protection. Use when reviewing code, auth/authz, APIs, or before deployment.
Share bugs, ideas, or general feedback.
Use this skill when the task is to review or harden Rails code from a security perspective.
Core principle: Prioritize exploitable issues over style. Assume any untrusted input can be abused.
BEFORE returning your security review, verify:
1. The FIRST finding section in your output is "Authentication & Authorization"
2. SQL injection, XSS, or other findings come AFTER auth/authz — even if
they feel more severe or were discovered first
3. If no auth/authz issue exists, the report still opens with an explicit
"Authentication & Authorization: no issues found" line BEFORE any other
finding category
| Area | Key Checks |
|---|---|
| Auth | Permissions on every sensitive action |
| Params | No permit!, whitelist only safe attributes |
| Queries | Parameterized — no string interpolation in SQL |
| Redirects | Constrained to relative paths or allowlist |
| Output | No html_safe/raw on user content |
| Secrets | Encrypted credentials, never in code or logs |
| Files | Validate filename, content type, destination |
html_safe on a developer-defined constant, not user input).High-severity (unscoped redirect):
# Bad: user-controlled redirect — open redirect / phishing risk
redirect_to params[:return_to]
# Good: relative path only
redirect_to root_path
# Good: allowlist
SAFE_PATHS = %w[/dashboard /settings].freeze
redirect_to(SAFE_PATHS.include?(params[:return_to]) ? params[:return_to] : root_path)
Medium-severity (mass assignment):
# Bad: privilege escalation risk
params.require(:user).permit!
# Good: explicit whitelist — never include role, admin, or privilege fields
params.require(:user).permit(:name, :email)
See PITFALLS.md for the full list. Critical anti-patterns: permit! on any parameter set, html_safe on user content, SQL string interpolation, secrets in committed files.
Section order per the HARD-GATE. Every heading appears even when empty (write "No issues found.").
## Authentication & Authorization
## Parameter Handling & Mass Assignment
## Query Safety (SQL / NoSQL / shell injection)
## Output Encoding & Redirects
## Secrets, Logging & Operational Exposure
Each finding carries:
app/controllers/documents_controller.rb:42| Skill | When to chain |
|---|---|
| rails-code-review | For full code review including non-security concerns |
| rails-architecture-review | When security issues stem from architectural problems |
| rails-migration-safety | When reviewing migration security (data exposure, constraints) |