security-review

name	security-review
description	Basic security review for common vulnerabilities.

security-review Skill

Trigger: "auth", "input", "sanitize", "password", "token", "SQL", "XSS"

Purpose: Basic security review for common vulnerabilities.

When to Use

Auto-invoked when Builder works on:

• Authentication/authorization code
• Input handling
• Database queries
• User-facing output

Severity Levels

CRITICAL (Must Fix)

• SQL injection (string concatenation in queries)
• Hardcoded secrets (API keys, tokens)
• eval() or Function() usage
• Unsafe deserialization

HIGH (Should Fix)

• Missing input validation
• XSS vulnerabilities (innerHTML, document.write)
• Insecure randomness (Math.random for crypto)
• Path traversal

MEDIUM (Fix if Time)

• Missing rate limiting
• Weak password policies
• Missing CSRF protection

LOW (Nice to Have)

• HTTP instead of HTTPS
• Missing security headers
• Verbose error messages

Auto-Fixes (Safe)

Can auto-fix:

• Extract hardcoded secrets to env vars
• Add basic input validation
• Replace HTTP with HTTPS

Cannot auto-fix (manual required):

• SQL injection refactoring
• Complex auth logic
• Cryptographic changes