security-review

Stars3

Forks0

UpdatedMay 19, 2026 at 18:06

Checklist-driven security review pass for pull requests.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

crewship-ai

crewship-ai/crewship

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.

More from this repository

same repository

routine-author

crewship-ai/crewship

Author a Crewship routine (repeatable declarative workflow) from a natural-language goal. Use when asked to build, create, or automate a repeatable routine or workflow ("make a routine that…", "automate X", "set up a recurring job that…").

2026-06-303

claude-api

crewship-ai/crewship

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`; user asks for the Claude API, Anthropic SDK, or Managed Agents; user adds/modifies/tunes a Claude feature (caching, thinking, compaction, tool use, batch, files, citations, memory) or model (Opus/Sonnet/Haiku) in a file; questions about prompt caching / cache hit rate in an Anthropic SDK project. SKIP: file imports `openai`/other-provider SDK, filename like `*-openai.py`/`*-generic.py`, provider-neutral code, general programming/ML.

2026-05-053

name	security-review
description	Checklist-driven security review pass for pull requests.
license	MIT

Security Review

When asked to review a pull request, walk through the following checklist and report findings inline:

Input validation — any user-controlled input that reaches a shell, SQL query, file path, or URL must be either escaped or parameterised. Flag any concatenation.
AuthN/AuthZ — every new endpoint must consult the same auth middleware as its peers. Routes registered without a guard are defects.
Secrets in code — flag any string that looks like an API key, token, or certificate. Suggest moving to the credentials vault.
Dependency pins — flag bumps that widen version ranges or downgrade transitive deps.
Logging — assert that credentials, PII, and full request bodies are NOT logged. Flag any log / console.log of headers, query params, or environment dumps.

Output format: a bulleted list grouped by severity (HIGH / MEDIUM / LOW). For each finding include the file + line range and a one-line suggested fix.