skills.rest
carlopezzuto
carlopezzutoCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review

Identify and remediate security risks in authentication, input handling, secrets, and API endpoints.

3|1|Updated Nov 5, 2025
Search Tags:#security#authentication#input-validation#risk-assessment#code-review#secure-development#secrets-management
One-click install
npx skills add https://github.com/carlopezzuto/agents --skill security-review-carlopezzuto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/carlopezzuto/agents/tree/main/.claude/skills/security-review
Command: npx skills add https://github.com/carlopezzuto/agents --skill security-review-carlopezzuto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security vulnerabilities in authentication, input handling, secrets management, and API design slow delivery and risk compliance. This skill provides a structured approach to identify, prioritize, and remediate these issues across the development lifecycle.

Core Features & Use Cases

  • Secrets management: enforce environment-based configuration, avoid hardcoded keys, and verify secret presence.
  • Input validation and data protection: standardize input schemas, validate against schemas, and prevent injection attacks.
  • Authentication & authorization design: ensure secure token handling, proper session management, and least-privilege access.
  • Secure deployment & auditing: maintain pre-deployment checklists, logging hygiene, and dependency vetting.

Quick Start

Run a security review checklist against a new feature, focusing on authentication, secrets, input validation, and HTTP API protections.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on my code before deployment?▼

A security review checks authentication, input validation, secrets management, and API endpoints. You run a checklist against new features to enforce secure patterns like parameterized queries and CSRF protection before deployment.

What is environment-based secrets management and how does it prevent hardcoded keys?▼

Environment-based secrets management enforces configuration through explicit environment variables rather than hardcoded keys. It verifies secret presence during code reviews to ensure sensitive credentials are never exposed in the application source.

How do I prevent injection attacks during input validation and schema standardization?▼

Preventing injection attacks requires standardizing input schemas and validating all inputs against them. This approach blocks malformed data from reaching backend systems and enforces secure data protection patterns.

Can I use this security review approach for API design and HTTP protections?▼

Yes, the security review applies to API design scenarios by enforcing HTTP API protections like CSRF tokens and secure logging. It ensures proper authentication, authorization, and least-privilege access controls across endpoints.

What's the best way to structure authentication and authorization design for secure token handling?▼

Secure authentication design ensures proper token handling, session management, and least-privilege access. It verifies that authorization flows comply with best practices and prevents unauthorized access during feature development.

Why do I need pre-deployment security checklists for dependency vetting and logging hygiene?▼

Pre-deployment security checklists are needed to maintain logging hygiene and vet dependencies for known vulnerabilities. They provide a structured approach to identify, prioritize, and remediate compliance risks before release.

Related Skills

Explore More Software Engineering Skills→
baan-pressbaan-press

security-scan

Scan codebases for security vulnerabilities in authentication, API endpoints, dependencies, and secrets.

Official
Advanced
qa-amanqa-aman
19

deployment-checklist

Enforce pre-, during-, and post-deployment checks for production releases.

Community
Intermediate
mitul-bhatiamitul-bhatia

perl-security

Harden Perl applications with taint mode, input validation, and parameterized DBI queries.

Community
Advanced
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate