security-review

Review application code for injection, authorization, XSS/CSRF, and data leak vulnerabilities.

2|Updated Apr 2, 2026

Search Tags:#authorization #xss #owasp #secure coding #security review #api security #csrf

Ready to run

npx skills add https://github.com/cassioalexandre/agf --skill security-review-cassioalexandre

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/cassioalexandre/agf/tree/main/.agents/skills/security-review
Command: npx skills add https://github.com/cassioalexandre/agf --skill security-review-cassioalexandre

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It reduces security risk by helping you identify and prevent common vulnerabilities that lead to account takeover, data leaks, and exploitability in production systems.

Core Features & Use Cases

Input validation & sanitization using allowlists, strict typing, and safe serialization patterns.
Injection prevention by enforcing parameterized queries and safe handling of dynamic query components.
Auth, XSS/CSRF, and sensitive data controls including least-privilege authorization, contextual output encoding, CSRF defenses, and strict rules to avoid PII and secret leakage in logs.

Quick Start

Ask the AI agent to perform a security review of the changed endpoints and data flow in your project and produce a prioritized list of vulnerabilities and fixes aligned with the OWASP Top 10 and the skill’s audit vectors.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review my code for injection flaws and XSS vulnerabilities?▼

Reviewing code for injection flaws and XSS vulnerabilities requires enforcing strict input validation with allowlists, parameterized queries for database access, and contextual output encoding to prevent malicious script execution and unauthorized data exposure.

What is the best way to prevent CSRF and authorization gaps in API handlers?▼

Preventing CSRF and authorization gaps in API handlers involves implementing least-privilege access controls, applying CSRF defense tokens, and enforcing strict input validation to ensure only authenticated users can access sensitive endpoints and modify state.

How does a security review identify sensitive data leaks in application logs?▼

A security review identifies sensitive data leaks by auditing application logging logic against strict rules designed to prevent PII and secret leakage, ensuring that authentication tokens, personal information, and credentials are never written to operational logs.

Can I use automated security review for infrastructure decisions and service implementations?▼

Yes, you can apply security review to infrastructure decisions and service implementations by enforcing zero-trust operational guardrails, verifying secure upload practices, and checking header configurations across web and service layers to harden production systems.

How do I align my application security audit with the OWASP Top 10?▼

Aligning an application security audit with the OWASP Top 10 involves reviewing changed endpoints and data flows to produce a prioritized list of vulnerabilities and fixes, targeting injection flaws, authorization gaps, XSS, CSRF, and sensitive data exposure.

Why does my API still have authorization gaps after implementing input validation?▼

API authorization gaps persist after input validation when least-privilege checks are not enforced at the endpoint level, meaning every data access request must independently verify user permissions rather than relying solely on sanitized inputs.