Menu
Performs security review on code changes
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Validates Go concurrency patterns
Validates Go context.Context usage patterns
Validates Go error handling patterns
Reviews code for Hexagonal Architecture compliance
Validates Go interface design and abstractions
Validates Go struct tags for serialization
| name | security-review |
| description | Performs security review on code changes |
Review code for security vulnerabilities. Every finding must include: file, line, vulnerability class, and a specific remediation. Do not report speculative issues — only findings backed by evidence in the code.
<investigate_before_answering> Read the actual code before making security claims. Never assume a vulnerability without evidence. </investigate_before_answering>
1. [ ] No hardcoded secrets, API keys, or credentials — use `os.Getenv` or config loader 2. [ ] No sensitive data in logs (passwords, tokens, PII) 3. [ ] All user input validated before use 4. [ ] Errors do not expose internal paths or stack traces 5. [ ] SQL queries parameterised — no string concatenation 6. [ ] `govulncheck` passing — no known CVEs in dependencies 7. [ ] Ensure compliance with `rules/security.md`