cc-skill-security-review

name	cc-skill-security-review
description	This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.
type	skill
created	2026-02-27T00:00:00.000Z
domain	security
category	app-security
risk	unknown
source	community
tags	["skill","security","app-security","review"]

Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

When to Use

• Implementing authentication or authorization
• Handling user input or file uploads
• Creating new API endpoints
• Working with secrets or credentials
• Implementing payment features
• Storing or transmitting sensitive data
• Integrating third-party APIs

Security Checklist

1. Secrets Management

❌ NEVER Do This

const apiKey = "sk-proj-xxxxx"  // Hardcoded secret
const dbPassword = "password123" // In source code

✅ ALWAYS Do This

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

Verification Steps

• No hardcoded API keys, tokens, or passwords
• All secrets in environment variables
• .env.local in .gitignore
• No secrets in git history
• Production secrets in hosting platform (Vercel, Railway)

2. Input Validation

Always Validate User Input

import { z } from 'zod'

// Define validation schema
const  = z.({
  : z.().(),
  : z.().().(),
  : z.().().().()
})


   () {
   {
     validated = .(input)
      db..(validated)
  }  (error) {
     (error  z.) {
       { : , : error. }
    }
     error
  }
}