# Security Review Checklist (security-review)

> A security checklist with code patterns for secrets, input validation, SQL injection, auth, XSS, CSRF, rate limiting, sensitive data and dependencies.

- Category: [Security Audit](https://www.myskills.tools/en/categories/security-audit/)
- Source: Community · Affaan Mustafa
- Repository: https://github.com/affaan-m/ECC/tree/main/skills/security-review (commit afa5651)
- SKILL.md: https://github.com/affaan-m/ECC/blob/main/skills/security-review/SKILL.md
- Install command: `npx skills add affaan-m/ECC --skill security-review`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor, Copilot, OpenCode
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

Never hardcode API keys, tokens or passwords; keep all secrets in environment variables.

## Execution Phases

1. **Spot the trigger** — Check whether the work involves auth, user input or uploads, new API endpoints, secrets, payments, sensitive data or third-party APIs.
2. **Walk the checklist** — Check secrets, input validation, parameterized queries, auth, XSS, CSRF, rate limiting, sensitive data exposure and Solana blockchain security.
3. **Check dependencies** — Run npm audit, keep dependencies updated, commit lock files, and use npm ci in CI.
4. **Write security tests** — Write automated tests for authentication (401), authorization (403), invalid input (400) and rate limiting (429).
5. **Pre-deployment check** — Before any production deployment, go through the checklist, including HTTPS, security headers, CORS, logging and Supabase row level security.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Changes code to follow the checklist patterns and adds security tests. |
| Command execution | Limited | Runs dependency commands such as npm audit, npm update and npm outdated, plus tests. |
| Network outbound | Limited | Dependency commands such as npm audit contact the npm registry. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: security-review
description: Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
metadata:
  origin: ECC
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/security-review/