Menu
Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Use when implementing features, fixing bugs, refactoring code, optimizing performance, resolving deprecations, or any multi-step development task requiring planning, implementation, testing, and review. Orchestrates specialized agent teammates through research, architecture, coding, QA, code review, adversarial review, and documentation phases. Triggers on: "implement", "build", "fix bug", "refactor", "add feature", "develop this", "help me build", "add functionality", "optimize performance", "resolve deprecation", "systematic development". Do NOT trigger on: simple questions ("what does this code do?"), file searches ("where is the auth function?"), one-off commands ("run the tests"), code explanations, quick edits, or non-development tasks.
Multi-lens adversarial review with Skeptic, Architect, and Minimalist lenses and 7+ attack vectors
Auto-improve any agent prompt using Karpathy's autoresearch method with iterative test-measure-improve loops
Safety guardrail that blocks destructive commands for the current session
Core development rules and philosophy for coding standards, git practices, and quality guidelines
Directory freeze guardrail that restricts file edits to a specific directory for the current session
| name | security-review |
| description | Comprehensive security review skill for authentication, user input, secrets, API endpoints, and OWASP Top 10 |
Provide comprehensive security checklist and patterns when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Flags secrets, SSRF, injection, unsafe crypto, and OWASP Top 10 vulnerabilities.
Triggers on: adding authentication, handling user input, working with secrets, creating API endpoints, implementing payment/sensitive features
Run npm audit, eslint-plugin-security, grep for hardcoded secrets, check exposed env vars. Check each category — injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging. Financial security (atomic transactions, balance checks, rate limiting), blockchain security (wallet signatures, private keys, slippage protection), authentication (JWT validation, session management), database (RLS, parameterized queries), API (auth required, input validation, CORS). Findings by severity (Critical/High/Medium/Low) with: description, impact, proof of concept, remediation code, OWASP/CWE references. No hardcoded secrets — use environment variables Parameterized queries only — no string interpolation in SQL No shell command injection — use libraries, not exec() Hashed password comparison only — never plaintext Authorization check on every protected route Atomic transactions for financial operations with row locks Rate limiting on all financial and auth endpoints XSS prevention — never innerHTML with user input SSRF prevention — validate URLs against domain allowlist Sanitize logs — never log passwords, API keys, or full PII Defense in depth — multiple layers of security Least privilege — minimum permissions required Fail securely — errors must not expose data Don't trust input — validate and sanitize everything Verify context before flagging — not every finding is a vulnerability