/security-review

A skill for conducting security reviews on yorishiro-proxy code.

Argument Patterns

• /security-review — Full review
• /security-review ./internal/cert/... — Review specified packages only

Checklist

TLS / Certificates

• CA private key protection (file permissions, memory handling)
• Certificate expiration settings are appropriate
• TLS version restriction (TLS 1.2 or higher)
• Only safe cipher suites are used
• Certificate verification bypass is intentional and controlled

Network

• Default bind address is safe (localhost vs 0.0.0.0)
• Connection timeout settings
• Resource limits (max connections, buffer sizes)
• Resilience against malformed packets

Go-Specific

• Race condition risks (go test -race check)
• Goroutine leaks
• Correct defer usage (e.g., inside loops)
• Absence of unsafe package usage
• Input validation (header injection, etc.)

MCP / API

• MCP tool input validation
• Authentication and authorization mechanisms
• Error messages do not contain sensitive information

Steps

1. Read the source code of the target packages
2. Review against the checklist
3. Report findings classified by severity (Critical / High / Medium / Low)