verify-code

Perform a security review of the following code:

$ARGUMENTS

---

Instructions

Review the code provided in the arguments above for security vulnerabilities. If no code is provided in the arguments, ask the user to paste the code they want reviewed, or specify a file path to read.

Step 1 — Detect Technologies

Identify the language and frameworks from:

• File extension (.py → Python, .ts → TypeScript, .go → Go, etc.)
• Import statements (import django, require('express'), import React, etc.)
• Syntax patterns (def/class → Python, func → Go, public class → Java)
• Framework indicators (@app.route → Flask, useState → React, @Controller → Spring)

Step 2 — Build Focus Areas

Based on detected technologies, check for these vulnerability classes:

Python:

• Command injection via os.system(), subprocess with shell=True
• Unsafe deserialization: pickle.loads() on untrusted data
• eval() / exec() with dynamic/user-controlled input
• SQL injection via string formatting in queries
• Path traversal in file operations

JavaScript / TypeScript:

• XSS via innerHTML, document.write(), dangerouslySetInnerHTML
• Prototype pollution via object spread or Object.assign
• eval() or new Function() with dynamic content
• Insecure postMessage handlers
• Unvalidated redirects

React:

• dangerouslySetInnerHTML without sanitization
• User input rendered directly in JSX
• Sensitive data stored in component state or localStorage

Java:

• Statement instead of PreparedStatement for SQL
• Runtime.exec() with user-controlled input
• XML External Entity (XXE) vulnerabilities
• Unsafe deserialization

Go:

• SQL injection in raw queries
• Command injection in exec.Command
• Path traversal in file serving
• Race conditions in concurrent code

SQL:

• String concatenation in queries instead of parameterization
• Missing WHERE clause on UPDATE/DELETE
• SELECT * returning sensitive columns
• Privilege escalation via stored procedures