Skip to content
cccskills
FreePublished on GitHub

security-review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

The English summary is being prepared. Showing the original description.

See how to install

Files included (3)

  • SKILL.md2.9 KB
  • assets/security-checklist.md3.2 KB
  • references/vulnerability-patterns.md8.0 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Security Review Skill

Ensures all code follows security best practices and identifies potential vulnerabilities.

When to Activate

  • Implementing authentication or authorization
  • Handling user input or file uploads
  • Creating new API endpoints
  • Working with secrets or credentials
  • Implementing payment features
  • Storing or transmitting sensitive data
  • Integrating third-party APIs

Security Checklist Categories

Review each category. See references/vulnerability-patterns.md for WRONG/CORRECT code examples.

  1. Secrets Management -- No hardcoded secrets; all in env vars; .env* gitignored
  2. Input Validation -- Schema validation; file upload size/type/extension checks
  3. SQL Injection -- Parameterized queries only; no string concatenation
  4. Auth & Authorization -- httpOnly cookies; RBAC; row-level/object-level authorization where needed
  5. XSS Prevention -- DOMPurify for user HTML; CSP headers configured
  6. CSRF Protection -- CSRF tokens on state-changing ops; SameSite=Strict cookies
  7. Rate Limiting -- All endpoints rate-limited; stricter on expensive operations
  8. Data Exposure -- No secrets in logs; generic error messages to users
  9. High-Risk Integrations -- Payments, wallets, third-party APIs, and webhooks validated when present
  10. Dependencies -- npm audit clean; lock files committed; Dependabot enabled

Full checkbox checklist: assets/security-checklist.md

Pre-Deployment Checklist

Before ANY production deployment, confirm ALL of the following:

  • No hardcoded secrets, all in env vars
  • All user inputs validated
  • All queries parameterized
  • User content sanitized (XSS)
  • CSRF protection enabled
  • Proper token handling (httpOnly cookies)
  • Authorization role checks in place
  • Rate limiting on all endpoints
  • HTTPS enforced
  • Security headers configured (CSP, X-Frame-Options)
  • No sensitive data in error messages or logs
  • Dependencies up to date, no vulnerabilities
  • CORS properly configured
  • File uploads validated (size, type)

References


Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

ClickHouse database patterns, query optimization, analytics, and data engineering best practices for high-performance analytical workloads.

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

日本語の業務文書を作成・修正するときに使用する共通品質基準。事実性、確度、論理、簡潔さ、自然な日本語を守る。提案書、報告、技術説明、議事録、メール、Slack、要約、レビューに適用する。創作、広告コピー、コードや構造化データだけの生成には使用しない。

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

Universal coding standards, best practices, and patterns for TypeScript, JavaScript, React, and Node.js development.

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles.

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

Frontend development patterns for React, Next.js, state management, performance optimization, and UI best practices.

The English summary is being prepared. Showing the original description.

cloudnative-co/claude-code-starter-kit154Updated Oct 12, 2026

See all skills by cloudnative-co

Report a problem with this skill