security-reviewcommit afa5651SKILL.md · Security Audit
Security Review Checklist
A security checklist with code patterns for secrets, input validation, SQL injection, auth, XSS, CSRF, rate limiting, sensitive data and dependencies.
npx skills add affaan-m/ECC --skill security-reviewCommand selected. Copy it manually.
- Permissions
- read-repo
- write-files
- shell
- network
- Compatible with
- Claude Code, Codex, Cursor, Copilot, OpenCode
- GitHub
- 294.3k
- Source
- Community · Affaan Mustafa
- Status
- Scan passed
- License
- MIT
- Category
- Security Audit
Core rule
Never hardcode API keys, tokens or passwords; keep all secrets in environment variables.
Execution Phases
Phase 01Spot the trigger
Check whether the work involves auth, user input or uploads, new API endpoints, secrets, payments, sensitive data or third-party APIs.
Phase 02Walk the checklist
Check secrets, input validation, parameterized queries, auth, XSS, CSRF, rate limiting, sensitive data exposure and Solana blockchain security.
Phase 03Check dependencies
Run npm audit, keep dependencies updated, commit lock files, and use npm ci in CI.
Phase 04Write security tests
Write automated tests for authentication (401), authorization (403), invalid input (400) and rate limiting (429).
Phase 05Pre-deployment check
Before any production deployment, go through the checklist, including HTTPS, security headers, CORS, logging and Supabase row level security.
Permissions (summarised from SKILL.md)
| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Changes code to follow the checklist patterns and adds security tests. |
| Command execution | Limited | Runs dependency commands such as npm audit, npm update and npm outdated, plus tests. |
| Network outbound | Limited | Dependency commands such as npm audit contact the npm registry. |
SKILL.md frontmatter (YAML)
---
name: security-review
description: Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
metadata:
origin: ECC
---