What kind of credentials can the FTC Security Review detect?

It scans for a wide range of sensitive data including API keys, tokens, secrets, WiFi SSIDs, passwords (PSK), and competition-specific registration credentials.

Will this skill flag standard FTC Control Hub IP addresses as risks?

No, the skill includes a specific whitelist for standard FTC IPs like 192.168.43.1 and 192.168.49.1, ensuring these common robot connections are ignored during security audits.

How do I trigger a security audit using this skill?

You can run a targeted audit by using the command '/review --type security' within Claude Code or any compatible CLI environment.

Does this skill provide protection against code injection?

Yes, it checks for unsafe usage of dynamic execution functions like eval() and exec(), and ensures shell commands are properly escaped or parameterized.

FTC Security Review

Name: FTC Security Review
Author: ncssm-robotics

byncssm-robotics

•

安全与测试

Audits FTC robot code and scripts for security vulnerabilities, credential leaks, and unsafe file operations.

关于

The FTC Security Review skill provides a specialized auditing framework designed specifically for FIRST Tech Challenge (FTC) robotics projects. It automates the detection of sensitive data leaks such as WiFi credentials and API keys while enforcing best practices for file system access and code execution. By incorporating a built-in whitelist for standard FTC hardware IPs, it reduces false positives during reviews, allowing teams to ensure their code is secure, competition-ready, and free from common vulnerabilities like command injection or path traversal.

主要功能

Automated detection of hardcoded credentials, API keys, and WiFi passwords.
2 GitHub stars
FTC-specific IP address whitelisting for Control Hubs and Robot Controllers.
Code injection prevention for dynamic execution (eval/exec) and shell commands.
Path safety analysis to prevent absolute path usage and directory traversal.
Hardware configuration auditing to ensure hardware map compliance over literals.

使用场景

Auditing custom scripts and automation tools used within the FTC ecosystem for security flaws.
Vetting robot code before pushing to public GitHub repositories to prevent credential leaks.
Ensuring competition-compliant network and file configurations during the development lifecycle.

关于

主要功能

Automated detection of hardcoded credentials, API keys, and WiFi passwords.
2 GitHub stars
FTC-specific IP address whitelisting for Control Hubs and Robot Controllers.
Code injection prevention for dynamic execution (eval/exec) and shell commands.
Path safety analysis to prevent absolute path usage and directory traversal.
Hardware configuration auditing to ensure hardware map compliance over literals.

使用场景

Auditing custom scripts and automation tools used within the FTC ecosystem for security flaws.
Vetting robot code before pushing to public GitHub repositories to prevent credential leaks.
Ensuring competition-compliant network and file configurations during the development lifecycle.