Skill File

Code Quality & Security

Name: Code Quality & Security
Author: fjorge9-arch

Code quality assessment and security review — complexity metrics, OWASP, tech debt. USE FOR: code review, quality, complexity, coupling, cohesion, OWASP, security, secrets, LGPD, GDPR, tech debt, cyclomatic, SAST, SCA, DAST, secret detection, vulnerability, CVE, qualidade, segurança, revisão de código. DO NOT USE FOR: writing code (route to developer agent), writing tests (use test-engineering), CI/CD integration of scans (use cicd-orchestration).

fjorge9-arch0 starsApr 14, 2026

Occupation
Categories: Code Quality

Skill Content

Core Principle

Measure, don't opine. Every quality assessment is backed by metrics (cyclomatic complexity, coupling, cohesion, coverage). Every security finding references a specific vulnerability class (OWASP, CVE). The Code Reviewer is an objective evaluator — quantitative verdicts replace subjective opinions.

1. Complexity Metrics

1.1 Cyclomatic Complexity (CC)

Measures the number of independent paths through a function.

CC Range	Risk Level	Action
1-10	✅ Low	Simple, well-structured — accept
11-20	⚠️ Moderate	Consider refactoring — flag as Minor
21-50	🔴 High	Must refactor — flag as Major
> 50	🚫 Very High	Reject — flag as Critical

Calculation: CC = Edges - Nodes + 2 (for a single connected component)

Related Skills

Code Quality & Security | Skills Pool

LCOM*	Assessment	Action
0-0.3	✅ High cohesion	Methods use shared fields — well-designed class
0.3-0.7	⚠️ Moderate	Some methods don't share state — review
> 0.7	🔴 Low cohesion	Class does too many things — split

#	Category	What to Look For	Remediation Pattern
A01	Broken Access Control	Missing authZ checks, IDOR, path traversal	Deny by default, validate ownership per request
A02	Cryptographic Failures	Plaintext secrets, weak hashing (MD5/SHA1), missing TLS	Use bcrypt/argon2, enforce HTTPS, rotate keys
A03	Injection	String concatenation in SQL/NoSQL/OS commands	Parameterized queries, input validation, allowlists
A04	Insecure Design	Missing threat model, no rate limiting, business logic flaws	Threat modeling, abuse case testing, rate limits
A05	Security Misconfiguration	Default credentials, verbose errors in production, unnecessary features enabled	Hardened defaults, error handling without details
A06	Vulnerable Components	Outdated dependencies with known CVEs	SCA scanning, automated dependency updates
A07	Auth Failures	Weak passwords allowed, no MFA, broken session management	Password policy, MFA, secure session config
A08	Data Integrity Failures	Unsigned updates, insecure deserialization, tampered CI/CD	Signed artifacts, integrity checks, secure pipelines
A09	Logging Failures	Missing audit trail, log injection, PII in logs	Structured logging, log injection prevention, PII masking
A10	SSRF	Unvalidated URLs in server requests, internal network access	URL allowlists, network segmentation, disable redirects

Secret Type	Pattern	Example Match
AWS Access Key	`AKIA[0-9A-Z]{16}`	`AKIAIOSFODNN7EXAMPLE`
AWS Secret Key	`[0-9a-zA-Z/+=]{40}` (near AWS context)	Base64-like 40-char string
GitHub Token	`gh[ps]_[0-9a-zA-Z]{36,}`	`ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
Azure Storage Key	`[A-Za-z0-9+/=]{88}`	88-char base64 string
JWT	`eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+`	`eyJhbGciOi...`
Generic API Key	`(?i)(api[_-]?key\|apikey\|api_secret)['":\s][=:]\s['"][A-Za-z0-9]{20,}`	`API_KEY = "abc123..."`
Connection String	`(?i)(password\|pwd\|passwd)[=:][^\s;]{8,}`	`password=mySecretPwd`

1. Immediately rotate the exposed secret
2. Remove from Git history (git filter-branch or BFG Repo Cleaner)
3. Add to .gitignore or use environment variables
4. Add pre-commit hook to prevent recurrence
5. Document incident in security log

Severity	Criteria	SLA
Critical	Exploitable vulnerability, data exposure, auth bypass	Block PR — fix immediately
Major	High complexity (CC>20), missing auth checks, no input validation	Block PR — must fix before approval
Minor	Style issues, naming conventions, minor code smell	Advisory — fix recommended, not blocking
Info	Suggestions, alternative approaches, optimization opportunities	Optional — developer decides

# Code Review Report — PR #[number]

## Verdict: [APPROVE | REQUEST_CHANGES]
## Iteration: [1/3 | 2/3 | 3/3]

## Summary
[One paragraph: overall code quality assessment]

## Findings

### Critical
- **[CRT-1]** `[file:line]` — [Description]
  - **Category:** [OWASP A0X | Complexity | Secret]
  - **Risk:** [What could go wrong]
  - **Fix:** [Specific remediation]

### Major
- **[MAJ-1]** `[file:line]` — [Description]
  - **Fix:** [Remediation]

### Minor
- **[MIN-1]** `[file:line]` — [Description]

### Info
- **[INF-1]** [Suggestion]

## Metrics Dashboard

| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Cyclomatic Complexity (max) | [N] | ≤ 20 | [PASS/FAIL] |
| Test Coverage (changed code) | [N]% | ≥ 80% | [PASS/FAIL] |
| CBO (max class) | [N] | ≤ 8 | [PASS/FAIL] |
| Code Duplication | [N]% | ≤ 5% | [PASS/FAIL] |
| Secrets Detected | [N] | 0 | [PASS/FAIL] |
| OWASP Findings (Critical+Major) | [N] | 0 | [PASS/FAIL] |

## OWASP Checklist (Scanned)
- [ ] A01: Access Control
- [ ] A02: Cryptography
- [ ] A03: Injection
- [ ] A04: Insecure Design
- [ ] A05: Misconfiguration
- [ ] A06: Vulnerable Components
- [ ] A07: Authentication
- [ ] A08: Data Integrity
- [ ] A09: Logging
- [ ] A10: SSRF

Check	What to Verify
Data Minimization	Only collect data needed for the stated purpose
Consent	User consent obtained before processing personal data
Right to Deletion	Mechanism exists to delete user data on request
Data Portability	Export user data in machine-readable format
PII in Logs	No personal data in log files (mask email, IP, names)
Encryption at Rest	Sensitive data encrypted in database
Encryption in Transit	All API communication over TLS 1.2+
Data Retention	Automated deletion after retention period

CBO	Assessment	Action
0-4	✅ Low coupling	Accept
5-8	⚠️ Moderate	Review dependencies, consider DI
> 8	🔴 High coupling	Flag as Major — extract interface, apply DI

Threshold	Action
0-3%	✅ Accept
3-5%	⚠️ Minor — consider extraction
> 5%	🔴 Major — extract shared functions/modules

	Low Impact	Medium Impact	High Impact
High Likelihood	Medium Risk	High Risk	Critical Risk
Medium Likelihood	Low Risk	Medium Risk	High Risk
Low Likelihood	Negligible	Low Risk	Medium Risk

Code Quality & Security

Core Principle

1. Complexity Metrics

1.1 Cyclomatic Complexity (CC)

Code Quality & Security

Core Principle

1. Complexity Metrics

1.1 Cyclomatic Complexity (CC)

1.2 Coupling — CBO (Coupling Between Objects)

1.3 Cohesion — LCOM* (Lack of Cohesion of Methods)

1.4 Code Duplication

2. OWASP Top 10 — Review Checklist

3. Secret Detection

3.1 Regex Patterns

3.2 Shannon Entropy

3.3 Remediation

4. Severity Classification

5. Review Report Template

6. Risk Assessment Matrix (RAM)

7. LGPD/GDPR Compliance Checks

When to Load References

Openclaw Release Maintainer

Verify

Flow

Fix

Hygiene

Add Policy