plain-prompt
Security-review an automation script
Check input trust, quoting, secrets, privileges, downloads, and destructive paths.
- Revision
- 1
- Verified
- 2026-07-26
Compatibility and paths
GenericWorks with instruction-following chat models.
ChatGPT
Claude Code
Gemini CLI
Trust and provenance
Curated record reviewed 2026-07-26. Results still depend on the supplied context and target environment.
Fill variables
Values stay in this browser tab and are not stored.
Generated asset2 required field(s) must be completed
Objective: Return exploitable findings with exact evidence and safer patterns.
Context: Do not execute or rewrite the entire script without explaining findings.
Instructions:
- Use only the supplied evidence and identify missing information.
- Lead with the finding, confidence, and one safe next action.
- Put read-only checks before mutations and include a stop condition.
- Never request or reproduce secrets, credentials, or private keys.
User request:
Runtime and trust boundary:
{{environment}}
Script:
{{evidence}}
Perform a security review.
Required output:
- Finding
- Evidence
- Confidence
- Safe next check
- Stop conditionReal example
Input
Bash CGI helper: eval "tar -xf $QUERY_STRING"; runs as root
Expected result
Critical: untrusted request data reaches `eval` under root, enabling command injection. Remove eval, parse an allowlisted archive identifier, drop privileges, and use argv-safe extraction.