elixir-security-review

What This Skill Does

The elixir-security-review skill is a specialized security auditor designed for the OpenClaw AI agent to perform deep inspections of Elixir and Phoenix application code. It specifically targets common foot-guns in the Erlang VM ecosystem, such as atom exhaustion, dangerous code execution, and improper secret management. By acting as a static analysis layer, it helps developers prevent critical security regressions before they are merged into the codebase. The skill uses a structured checklist to ensure consistency and follows the rigorous review-verification-protocol, ensuring that false positives are minimized and potential vulnerabilities are validated against the context of the running application.

Installation

To integrate this security auditor into your environment, run the following command in your terminal: clawhub install openclaw/skills/skills/anderskev/elixir-security-review This will link the module to your agent, enabling the security review context for your repository analysis sessions.

Use Cases

This skill is ideal for:

1. Pull Request Reviews: Automating the check for dangerous functions like String.to_atom when processing API requests.
2. Security Auditing: Scanning configuration files to ensure that secrets are not committed to source control and are instead loaded via runtime environment variables.
3. Legacy Code Cleanup: Identifying unsafe use of :erlang.binary_to_term that could lead to remote code execution (RCE) via serialized malicious input.
4. Performance Safety: Reviewing ETS table access settings to ensure sensitive data is not exposed to the entire VM.

Example Prompts

1. "Perform a security audit on lib/my_app_web/controllers/upload_controller.ex focusing on input sanitization and potential atom exhaustion."
2. "Review the current repository for any hardcoded secrets and verify that the config/runtime.exs is configured to use environment variables for database credentials."
3. "Analyze the use of binary_to_term in our message parsing module. Is the current implementation safe given that it processes untrusted user data?"

Tips & Limitations

To maximize the effectiveness of this skill, ensure you provide the agent with the relevant context of the codebase. The skill is context-aware; it will not flag String.to_atom if it detects that the input is a compile-time constant or a hardcoded string. However, it is a static analysis tool and cannot predict runtime behavior perfectly. Always follow the review-verification-protocol before declaring a finding as a critical bug. When dealing with complex macro-generated code, you may need to provide additional details about how the modules are being compiled or invoked to assist the agent in its reasoning.