Copilot-Skills: Instructions file for GitHub Copilot

Security Review Instructions

Auto-loaded when working with security-sensitive code or conducting security reviews.

Activation

This file loads automatically when:

• Editing authentication/authorization code
• Working with database queries
• Handling user input or API endpoints
• Reviewing cryptographic implementations
• Auditing dependencies or package files
• Analyzing security configurations

File Patterns

• **/auth* - Authentication code
• **/login* - Login handlers
• **/*security* - Security modules
• **/api/** - API endpoints
• **/middleware/** - Middleware (auth, CORS, etc.)
• **/*crypto* - Cryptographic code
• **/requirements.txt - Python dependencies
• **/package.json - Node.js dependencies
• **/go.mod - Go dependencies
• **/Cargo.toml - Rust dependencies

Quick Security Checks

When reviewing code, automatically check for:

1. Injection Vulnerabilities

• String concatenation in SQL queries
• eval(), exec(), subprocess with user input
• Unsanitized template rendering

2. Authentication Issues

• Missing authentication middleware
• Weak session configuration
• Insecure password storage
• Missing authorization checks

3. Data Exposure

• Hardcoded API keys, passwords, tokens
• Sensitive data in logs
• Stack traces exposed to users
• PII without proper handling

4. Cryptography

• MD5, SHA1 for passwords (use bcrypt/pbkdf2)
• random instead of secrets
• Weak encryption algorithms

5. Input Validation

• Missing validation on user input
• Type confusion risks
• Buffer overflow potential

Quick Reference

Run Security Scan

bash .github/copilot-skills/security/security-review/scripts/scan.sh --path .

Check Specific Category

# Injection
bash scan.sh --path . --category injection

# Secrets
bash scan.sh --path . --category secrets

# Dependencies
python3 analyze_dependencies.py .

Common Patterns to Flag

Python

# ⚠️ Flag these patterns
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
os.system(f"ls {path}")
API_KEY = "sk_live_1234567890"
hashlib.md5(password.encode())
random.randint(1000, 9999)