Use when developer explicitly asks to review an endpoint, controller, service, or API for security issues. Also triggers on: "review this for security", "is this secure", "check this endpoint", "security audit", "what are the vulnerabilities here", or when asked to review a full route file or controller file. This is the comprehensive holistic review skill — covers all OWASP API Top 10 2023 in one pass.
Use when developer is implementing authentication, building login/logout flows, writing JWT validation, adding middleware, creating role-based access control, building permission systems, or asking how to protect routes. Also triggers on keywords: auth, bearer token, JWT, session, middleware, permissions, roles, scopes, OAuth. Generates secure auth patterns and catches insecure implementations — OWASP API2:2023 (Broken Authentication) and API5:2023 (Broken Function Level Authorization).
Use when writing or reviewing any API endpoint that retrieves, updates, or deletes a record by user-supplied ID. Triggers on route handlers with :id params, controller functions calling findById/findOne/get_object_or_404, Prisma findUnique, Spring repository.findById, or any ORM lookup by identifier. Does NOT trigger on generic "review this endpoint" requests — use api-security-review for holistic reviews. This skill focuses narrowly on object-level authorization. Detects BOLA / IDOR — OWASP API1:2023.
Use when writing database queries, file system operations, shell commands, XML/HTML processing, template rendering, or any operation that incorporates user-supplied input into a command or query. Triggers on: SQL queries, MongoDB queries, Mongoose queries, file path construction, exec/spawn/system calls, template engines, XML parsing, LDAP queries, GraphQL queries built from user input. Detects injection vulnerabilities — mapped to OWASP API8:2023 (the OWASP API Top 10 has no dedicated injection category; injection is a cross-cutting concern that also touches API4:2023 for resource exhaustion via GraphQL abuse).
Use when developer is writing, reviewing, or editing an OpenAPI spec (swagger.yaml, openapi.yaml, openapi.json), defining API schemas with zod/joi/yup/pydantic, writing JSON Schema definitions, or asking how to define API contracts. Also triggers on: "define this schema", "add validation", "write the OpenAPI spec", "schema for this endpoint", swagger, jsonschema. Tightens loose definitions that create security surface area — OWASP API3:2023 (Broken Object Property Level Authorization).
Use when developer is writing tests, asked to add test coverage, writing Jest/Mocha/pytest/JUnit test files, or when reviewing an endpoint that has only happy-path tests. Also triggers when developer says "write tests for this", "add test coverage", or "what should I test here". Generates security-focused test cases that complement functional tests — covering auth bypass, privilege escalation, injection, mass assignment, and rate limiting.