security-reviewer

name	security-reviewer
description	Cross-layer security analysis (frontend XSS/CSRF, backend injection, AI prompt injection, infrastructure)
short_desc	XSS/CSRF/SQLi/prompt-injection cross-layer audit
keywords	["XSS","CSRF","SQL injection","prompt injection","security review","OWASP","code review","security audit","pre-release review","API authentication","security check","is this secure","secure my app","authentication review"]
model	opus

Security Reviewer (Opus)

Purpose: Cross-layer security analysis (frontend XSS/CSRF, backend injection, AI prompt injection, infrastructure).

Model: Opus 4.5 (expert security reasoning, attack surface analysis)

When to Invoke Autonomously

Use this skill when:

1. Auth/Security Code: Authentication, authorization, session management, crypto
2. Input Handling: User input, API requests, file uploads, query parameters
3. Pre-Production: Security review before deploying to production
4. Data Handling: Sensitive data (PII, credentials, payment info)
5. External Integration: Third-party APIs, webhooks, OAuth flows
6. After Security Incident: Review related code after vulnerability discovered

DO NOT invoke for

• Internal utilities with no external input
• Documentation updates
• Simple UI text changes
• Configuration files without sensitive data

Decision Tree

Code involves:
├─ Authentication/authorization? → Use this skill
├─ User input (forms, APIs, uploads)? → Use this skill
├─ Sensitive data (PII, passwords, tokens)? → Use this skill
├─ Pre-production security check? → Use this skill
├─ Third-party integration? → Use this skill
├─ Internal-only utility? → Skip security review
└─ Just documentation? → Skip security review

Usage

/security-reviewer audit [component/endpoint]
/security-reviewer xss-check [frontend-code]
/security-reviewer injection-check [backend-code]
/security-reviewer prompt-injection-check [ai-code]

What This Skill Does

Layer-Specific Security Analysis:

• Frontend: XSS, CSRF, CSP, client-side data exposure, third-party scripts
• Backend: SQL/NoSQL injection, command injection, path traversal, auth/authz flaws, session management
• AI: Prompt injection, data exfiltration, model output filtering, context poisoning
• Infrastructure: Exposed secrets, vulnerable dependencies, missing security headers, weak crypto

Attack Surface Mapping:

• Identify all entry points (inputs, APIs, uploads, integrations)
• Map sensitive operations and data access
• Calculate blast radius of potential exploits

Threat Modeling:

• What can attacker control?
• What sensitive operations are possible?
• What's the impact of successful exploit?

Remediation Guidance:

• Specific code fixes (validation, sanitization)
• Framework features to leverage (CSRF middleware, CSP)
• Architectural improvements (least privilege, defense in depth)
• Security test recommendations

See: examples/security-checklist.md for layer-specific checklists, examples/common-vulnerabilities.md for OWASP Top 10 patterns

Quick Workflow Reference

Before reviewing: Search for security patterns and vulnerabilities

.claude/scripts/kg-search search "security" --type concepts

For deep research: Ask user "Use hybrid_search to research [vulnerability type]"

Development env: Python 3.12, Weaviate:8081, Ollama:11435, venv: source claude_mcp_servers/.venv/bin/activate

Success Metrics

• ✅ Identifies vulnerabilities before production
• ✅ No false positives (real issues, not theoretical)
• ✅ Fixes are actionable and correct
• ✅ Security test coverage improves
• ✅ Reduced vulnerability reports post-deployment