| name | security-reviewer |
| description | Cross-layer security analysis (frontend XSS/CSRF, backend injection, AI prompt injection, infrastructure) |
| short_desc | XSS/CSRF/SQLi/prompt-injection cross-layer audit |
| keywords | ["XSS","CSRF","SQL injection","prompt injection","security review","OWASP","code review","security audit","pre-release review","API authentication","security check","is this secure","secure my app","authentication review"] |
| model | opus |
Security Reviewer (Opus)
Purpose: Cross-layer security analysis (frontend XSS/CSRF, backend injection, AI prompt injection, infrastructure).
Model: Opus 4.5 (expert security reasoning, attack surface analysis)
When to Invoke Autonomously
Use this skill when:
- Auth/Security Code: Authentication, authorization, session management, crypto
- Input Handling: User input, API requests, file uploads, query parameters
- Pre-Production: Security review before deploying to production
- Data Handling: Sensitive data (PII, credentials, payment info)
- External Integration: Third-party APIs, webhooks, OAuth flows
- After Security Incident: Review related code after vulnerability discovered
DO NOT invoke for
- Internal utilities with no external input
- Documentation updates
- Simple UI text changes
- Configuration files without sensitive data
Decision Tree
Code involves:
├─ Authentication/authorization? → Use this skill
├─ User input (forms, APIs, uploads)? → Use this skill
├─ Sensitive data (PII, passwords, tokens)? → Use this skill
├─ Pre-production security check? → Use this skill
├─ Third-party integration? → Use this skill
├─ Internal-only utility? → Skip security review
└─ Just documentation? → Skip security review
Usage
/security-reviewer audit [component/endpoint]
/security-reviewer xss-check [frontend-code]
/security-reviewer injection-check [backend-code]
/security-reviewer prompt-injection-check [ai-code]
What This Skill Does
Layer-Specific Security Analysis:
- Frontend: XSS, CSRF, CSP, client-side data exposure, third-party scripts
- Backend: SQL/NoSQL injection, command injection, path traversal, auth/authz flaws, session management
- AI: Prompt injection, data exfiltration, model output filtering, context poisoning
- Infrastructure: Exposed secrets, vulnerable dependencies, missing security headers, weak crypto
Attack Surface Mapping:
- Identify all entry points (inputs, APIs, uploads, integrations)
- Map sensitive operations and data access
- Calculate blast radius of potential exploits
Threat Modeling:
- What can attacker control?
- What sensitive operations are possible?
- What's the impact of successful exploit?
Remediation Guidance:
- Specific code fixes (validation, sanitization)
- Framework features to leverage (CSRF middleware, CSP)
- Architectural improvements (least privilege, defense in depth)
- Security test recommendations
See: examples/security-checklist.md for layer-specific checklists, examples/common-vulnerabilities.md for OWASP Top 10 patterns
Quick Workflow Reference
Before reviewing: Search for security patterns and vulnerabilities
.claude/scripts/kg-search search "security" --type concepts
For deep research: Ask user "Use hybrid_search to research [vulnerability type]"
Development env: Python 3.12, Weaviate:8081, Ollama:11435, venv: source claude_mcp_servers/.venv/bin/activate
Success Metrics
- ✅ Identifies vulnerabilities before production
- ✅ No false positives (real issues, not theoretical)
- ✅ Fixes are actionable and correct
- ✅ Security test coverage improves
- ✅ Reduced vulnerability reports post-deployment
