security-lens

Detect common security vulnerabilities in code reviews using Read, Grep, and Glob tools.

Updated Aug 23, 2026

Ready to run

npx skills add https://github.com/malston/claude-config --skill security-lens

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-lens
Source: https://github.com/malston/claude-config/tree/main/skills/security-lens
Command: npx skills add https://github.com/malston/claude-config --skill security-lens

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Apply security awareness during code review and implementation. This Lens helps catch common vulnerabilities without requiring a full security audit.

Core Features & Use Cases

Input Handling: Check for input validation, parameterized queries, and safe output encoding.
Authentication/Authorization: Verify access checks, session security, and privilege verification.
Data Exposure: Scan logs and outputs to avoid leaking secrets or PII.
Secrets: Ensure secrets are not hardcoded and are sourced from secure storage.
Use during code reviews to surface risk areas and support secure coding practices.

Quick Start

Apply the security-lens while reviewing code to flag issues related to input handling, authentication, data exposure, and secrets.
Consult the included owasp-quick-ref.md for detailed vulnerability patterns.

Frequently Asked Questions about security-lens

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security vulnerabilities during code review?▼

Security-lens scans code reviews for common vulnerabilities in input handling, authentication, data exposure, and secrets management. It validates parameterized queries, HTML escaping, path validation, session handling, error disclosure, and hardcoded secrets using lightweight pattern matching across your codebase.

What security checks does this tool apply to pull requests?▼

The tool flags risks in input validation, SQL injection prevention via parameterized queries, access control verification, PII and secret leakage in logs, and insecure credential storage. It uses Read, Grep, and Glob tools to detect these patterns without requiring a full security audit.

Can I use this during development to catch security issues early?▼

Yes. Apply security-lens while coding or reviewing to surface input handling gaps, authentication weaknesses, data exposure risks, and secrets management problems before they reach production. It integrates into development tasks and code review workflows.

What does input handling validation check for?▼

Input handling validation ensures parameterized queries prevent SQL injection, output is safely encoded with HTML escaping, file paths are validated to block traversal attacks, and user input is properly sanitized across the codebase.

How does this tool prevent secret leakage?▼

Secret management checks verify credentials are not hardcoded in source, environment variables or secure vaults are used instead, and logs or error messages do not expose sensitive data or PII that could be compromised.