Verify OWASP compliance and security patterns. Use when reviewing code for security vulnerabilities, checking for injection, or auditing tool usage.
From kodonpx claudepluginhub yannabadie/kodoclawThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
When reviewing code for security, verify the following areas systematically.
Check that external content is scanned before processing:
UserPromptSubmit hook (blocks at score >= 4)createMemCell() injection checkVerify sensitive path blocking covers:
.env, .env.* files.ssh/* (keys, config, known_hosts)isSensitivePath() and isConfidentialContent() in src/security/blocklist.tsVerify shell commands are classified correctly:
rm -rf /, mkfs, dd if=, format commandspython -c, node -e, docker run, PowerShell -enc, eval(), exec()classifyShellRisk() in src/security/policy.tsVerify LLM output scanning covers:
<script>, javascript: URIs, event handlers (onload=, onerror=)eval(), Function(), import(), child_processDROP TABLE, DELETE FROM, UNION SELECTrm -rf /src/security/output-guard.tsVerify memory system is tamper-resistant:
computeChecksum()verifyChecksum() detects tamperingloadMemCells() validates JSON with isMemCell() type guardVerify cryptographic operations:
timingSafeEqual with hex validation