tessl/code-review
The default review lenses for `tessl code review`, which the Tessl Code Review GitHub Action also runs. Each lens is its own skill, so a run can invoke one lens or several. Fork and tune any lens for your own repository.
64
80%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Passed
No findings from the security scan
SKILL.mdskills/review-security-and-privacy/
- name:
- review-security-and-privacy
- description:
- Review a change for what an adversary could do with it, and for what it exposes about people. Use as one lens in a code review run.
Review lens: Security and Privacy
Review changes at trust boundaries: places where data, code, or authority moves between components, users, or systems.
Scope
- Security Who can reach what, and what an untrusted input can do once it lands.
- Privacy What the change discloses, and to whom.
Method
Start from the boundaries the change touches rather than reading the diff in file order. Trace untrusted input to the operations it can influence, including indirectly executed code.
Follow the data outward as well: what each new field, log line, error message, or response body reveals, and who becomes able to see it.
Threshold
Report a finding when an untrusted input can reach a sensitive operation, or when data can be disclosed to a party that is not entitled to receive it.
Do not report hypothetical risks without a plausible path through the changed code.
Reporting
- Name the untrusted input, the sink it reaches, and the impact, in one or two sentences.
- State the concrete fix: validate at this boundary, parameterize this query, escape this output, move this secret to config. Not generic advice.