vm-secure-coding-reviewer

# Secure Coding Reviewer Skill

Reviews code for language-specific secure coding practices and unsafe patterns.

## Brownfield Context

This skill reviews **existing code** for unsafe constructs and anti-patterns. It is language-aware and operates without requiring test coverage or a greenfield baseline. When scoped from the Code Review Agent or Security Analysis Agent, it focuses on the set of files in the change set or the modules flagged in the impact analysis.

## When to Use This Skill

- Reviewing secure coding practices in inherited or existing codebases
- Detecting unsafe function usage in changed files
- Checking language-specific security patterns pre-release
- Identifying dangerous constructs in brownfield code changes

## Unitary Function

**ONE RESPONSIBILITY:** Check language-specific secure coding patterns and unsafe function usage

**NOT RESPONSIBLE FOR:**
- Authentication review (see vm-auth-auditor)
- Data protection (see vm-data-protection-reviewer)
- Injection detection (see vm-input-validation-checker)
- Compliance validation (see vm-compliance-checker)
- Fixing code issues (read-only skill)

## Input

```json
{
  "source_path": "Path to source code directory",
  "scope": "full|file_list",
  "files": ["optional explicit file list"],
  "languages": ["optional — auto-detected"],
  "focus": "unsafe-functions|dangerous-patterns|best-practices|all"
}
```

## Output

```json
{
  "audit_id": "uuid",
  "generated_by": {
    "skill": "vm-secure-coding-reviewer",
    "version": "1.0.0"
  },
  "timestamp": "ISO-8601",
  "source_path": "string",
  "languages_reviewed": ["Python", "JavaScript"],
  "risk_score": "Critical|High|Medium|Low",
  "findings": {
    "python": [
      {
        "severity": "High",
        "category": "Unsafe Function",
        "issue": "Use of eval() with user input",
        "location": "api/handler.py:23",
        "code": "eval(request.data['expression'])",
        "remediation": "Use ast.literal_eval() or avoid dynamic evaluation"
      }
    ],
    "javascript": [],
    "java": []
  },
  "recommendations": []
}
```

## Supported Languages

### Python
- Unsafe functions: eval(), exec(), compile(), __import__()
- Deserialization: pickle, yaml.load() without Loader
- Subprocess: shell=True usage
- Random: insecure random for security contexts

### JavaScript/TypeScript
- Unsafe functions: eval(), Function() constructor, setTimeout() with strings
- DOM manipulation: innerHTML, document.write()
- Prototype pollution patterns
- Regular expression DoS (ReDoS)

### Java
- Deserialization: ObjectInputStream without validation
- Reflection: Class.forName(), Method.invoke()
- XML parsing: XXE vulnerabilities
- Random: java.util.Random vs SecureRandom

### C#
- Deserialization: BinaryFormatter
- SQL: String concatenation in queries
- Cryptography: Weak or deprecated algorithms

### Go
- Command execution: exec.Command() with shell interpolation
- SQL: String concatenation in queries
- Crypto: Weak random, deprecated alg