safety-check

mway's avatarfrom mway

Audit code for runtime safety and security vulnerabilities. Use when reviewing code, before commits, or performing security assessments.

⭐4stars🔀0forks📁View on GitHub🕐Updated Jan 8, 2026
[Code Review]

When & Why to Use This Skill

The safety-check Claude skill is a comprehensive code auditing tool designed to identify critical runtime safety issues and security vulnerabilities. By automating the inspection of source code for common pitfalls like null pointer dereferences, race conditions, and OWASP Top 10 threats, it helps developers ensure application stability and harden software against potential exploits during the development lifecycle.

Use Cases

  • Pre-commit Security Audits: Automatically scan code changes for injection vulnerabilities and hardcoded secrets before they reach the repository.
  • Runtime Reliability Checks: Identify complex concurrency issues such as race conditions, deadlocks, and resource leaks in high-performance applications.
  • Automated Peer Review: Supplement manual code reviews with an objective safety checklist to catch edge cases like integer overflows or unhandled errors.
  • Legacy Code Assessment: Perform deep-dive security assessments on existing codebases to align with modern safety standards and cryptographic best practices.
namesafety-check
descriptionAudit code for runtime safety and security vulnerabilities. Use when reviewing code, before commits, or performing security assessments.
allowed-tools["shell", "read_file"]
short-descriptionComprehensive safety audit

Safety Audit

Read this reference:

  • ~/.config/agent/domain/coding/safety.md - Complete safety checklist (Part 1: Runtime, Part 2: Security)

Instructions

Perform comprehensive safety audit covering both runtime and security:

Part 1: Runtime Safety (9 Categories)

  1. Nil/Null Pointer Dereferences

    • All pointer dereferences checked
    • Optional/Result types properly unwrapped
    • No assumptions about non-nil values

  2. Race Conditions & Data Races

    • Shared mutable state properly synchronized
    • Mutex usage correct (defers, no double-locks)
    • No unprotected concurrent access

  3. Resource Leaks

    • File handles closed (defers)
    • Connections released
    • Memory freed (in manual-memory languages)
    • Contexts cancelled

  4. Buffer Overflows & Bounds Checking

    • Array/slice access within bounds
    • String operations safe
    • No unchecked buffer writes

  5. Integer Overflow/Underflow

    • Arithmetic checked for overflow
    • Type conversions validated
    • Size calculations safe

  6. Uninitialized Values

    • All variables initialized before use
    • No reliance on zero values unless intentional

  7. Error Handling

    • All errors checked and handled
    • No ignored errors
    • Error context preserved (wrapping)

  8. Panics/Crashes

    • No panic in library code (return errors)
    • Recover only where appropriate
    • Graceful degradation

  9. Deadlocks

    • Consistent lock ordering
    • No circular dependencies
    • Timeouts on blocking operations

Part 2: Security Safety (OWASP Top 10+)

  1. Injection Vulnerabilities

    • SQL injection (use parameterized queries)
    • Command injection (avoid shell, sanitize input)
    • XSS (escape output, CSP headers)

  2. Authentication & Authorization

    • Proper credential storage (hashed, salted)
    • Session management secure
    • Authorization checks on all resources

  3. Sensitive Data Exposure

    • No hardcoded secrets
    • Encryption for data at rest/in transit
    • No secrets in logs

  4. Input Validation

    • All external input validated
    • Type checking, range checking
    • Sanitization before use

  5. Cryptography

    • Use standard libraries (no custom crypto)
    • Secure random number generation
    • Proper key management

Arguments

Target file(s) or package(s): ${ARGUMENTS}