| name | security-review |
| description | Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10 |
Provide comprehensive security checklist and patterns when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Triggers on: adding authentication, handling user input, working with secrets, creating API endpoints, implementing payment/sensitive features
Run npm audit, eslint-plugin-security, grep for hardcoded secrets, check exposed env vars.
Check each category — injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging.
Financial security (atomic transactions, balance checks, rate limiting), blockchain security (wallet signatures, private keys, slippage protection), authentication (JWT validation, session management), database (RLS, parameterized queries), API (auth required, input validation, CORS).
Findings by severity (Critical/High/Medium/Low) with: description, impact, proof of concept, remediation code, OWASP/CWE references.
No hardcoded secrets — use environment variables
Parameterized queries only — no string interpolation in SQL
No shell command injection — use libraries, not exec()
Hashed password comparison only — never plaintext
Authorization check on every protected route
Atomic transactions for financial operations with row locks
Rate limiting on all financial and auth endpoints
XSS prevention — never innerHTML with user input
SSRF prevention — validate URLs against domain allowlist
Sanitize logs — never log passwords, API keys, or full PII
Defense in depth — multiple layers of security
Least privilege — minimum permissions required
Fail securely — errors must not expose data
Don't trust input — validate and sanitize everything
Verify context before flagging — not every finding is a vulnerability
