security-review

name	security-review
description	Use when code or config touches authentication, authorization, user input, secrets, tokens, database access, file access, external APIs, MCP servers, browser automation, dependency installation, or deployment.

Security Review

Use this skill to keep new capability from quietly becoming new attack surface.

Review Checklist

Check for:

• Secrets committed to the repo, logs, examples, or tests.
• Overbroad tokens, scopes, directories, database users, or MCP toolsets.
• Missing authorization checks after authentication succeeds.
• User input reaching shell, SQL, filesystem, templates, redirects, or HTML.
• Unsafe defaults in examples that users are likely to copy.
• Destructive actions without confirmation, dry-run, backup, or rollback.
• Third-party Skill or MCP packages enabled without source review.

MCP Defaults

Prefer:

• Official or well-maintained servers.
• Read-only mode when available.
• Narrow toolsets instead of all tools.
• Explicit allowed directories for filesystem access.
• Read-only database users.
• Environment variables or local secret stores, never committed secrets.

Output

List concrete risks first. Include exact file references and the smallest fix that reduces the risk.