security-review-checklists

Generate security review checklists covering OWASP Top 10 and STRIDE threat modeling.

1|Updated Dec 14, 2025

Search Tags:#code review #authorization #security #authentication #owasp #threat modeling #compliance

Ready to run

npx skills add https://github.com/komluk/scaffolding.template --skill security-review-checklists

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review-checklists
Source: https://github.com/komluk/scaffolding.template/tree/main/stacks/_common/.claude/skills/security-review-checklists
Command: npx skills add https://github.com/komluk/scaffolding.template --skill security-review-checklists

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides comprehensive checklists and guidelines to ensure code quality and security during the review process, mitigating common vulnerabilities and compliance risks.

Core Features & Use Cases

OWASP Top 10 & STRIDE: Covers major web vulnerabilities and threat modeling techniques.
Auth/Authz & Data Protection: Ensures robust authentication, authorization, and data handling practices.
Compliance & Input Validation: Aids in meeting regulatory requirements and securing input processing.
Use Case: Before merging a feature that handles user authentication, a developer can use the auth-checklist.md reference to ensure all security best practices are followed, preventing potential breaches.

Quick Start

Use the security-review-checklists skill to generate a checklist for reviewing API authentication endpoints.

Frequently Asked Questions about security-review-checklists

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I use OWASP Top 10 checklists for secure code review?▼

OWASP Top 10 checklists guide secure code review by mapping common web vulnerabilities to actionable verification steps. You systematically verify authentication, authorization, and input validation mechanisms against these established baseline checks to mitigate risks.

What is STRIDE threat modeling and when do I need it for API authentication?▼

STRIDE threat modeling categorizes security threats like spoofing, tampering, and repudiation. You need it for API authentication to systematically identify and mitigate potential breach vectors before merging features that handle user data.

Does this security review process cover data protection and compliance checks?▼

Yes, the security review process covers data protection and compliance checks. It enforces input validation rules and security headers, aiding in meeting regulatory requirements and ensuring robust application security during development.

What's the best way to check authorization and authentication best practices before merging?▼

The best way to check authorization and authentication best practices is referencing dedicated auth checklists. This ensures all security measures for user access controls are verified, preventing potential breaches before code integration.

How do I enforce input validation and security headers for application security?▼

You enforce input validation and security headers by applying specific security review checks. These guidelines secure input processing and enforce header configurations, providing robust application security against common misconfigurations.