security-review

Review API endpoints, UI flows, and data access for actionable vulnerabilities.

Updated Aug 12, 2025

Search Tags:#authorization #threat-modeling #api-security #dynamic-testing #security-review #risk-prioritization #vulnerability-assessment

Ready to run

npx skills add https://github.com/EdWrld/config.files --skill security-review-edwrld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/EdWrld/config.files/tree/main/skills/security-review
Command: npx skills add https://github.com/EdWrld/config.files --skill security-review-edwrld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Helps organizations identify and remediate security weaknesses across API endpoints, UI flows, and data access layers, reducing risk before deployment.

Core Features & Use Cases

Inventory and map API endpoints, UI flows, and data access points to understand risk exposure.
Apply threat modeling (STRIDE/LINDDUN) and generate prioritized findings.
Conduct deep-dive authorization, input validation, session handling, and data access audits.
Produce structured security reports with remediation steps and verification guidance.
Trigger dynamic testing and vulnerability intelligence workflows when a running system is available.

Quick Start

Provide a scoped security review plan for the given API endpoints, UI flows, and data access in the current system.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security review of my API endpoints and data access layers?▼

A security review inventories endpoints, maps data flows, and applies threat modeling to identify vulnerabilities. It evaluates authorization, input validation, and session handling, generating a structured report with prioritized fixes and verification steps.

What is STRIDE threat modeling and when is it needed for API security?▼

STRIDE threat modeling categorizes risks like spoofing, tampering, and elevation of privilege. It is needed during API security reviews to prioritize vulnerabilities systematically across endpoints, UI flows, and data access layers before deployment.

Can I run dynamic testing for vulnerability assessment if my system is already deployed?▼

Dynamic testing for vulnerability assessment can be triggered when a running system is available. It complements static review by actively probing API endpoints and UI flows to uncover runtime security weaknesses.

How do I audit authorization and session handling to prevent data access vulnerabilities?▼

Auditing authorization and session handling involves mapping data flows and evaluating access controls against threat models. This process identifies weaknesses in authentication layers and database interactions, producing actionable remediation steps.

Does this security review approach work for systems with web APIs and database interactions?▼

This security review approach is applicable to systems with web APIs, authentication layers, and database interactions. It scopes reviews to your specific endpoints and UI flows to evaluate risk exposure and produce targeted fixes.

What is the best way to prioritize vulnerabilities found during an API security audit?▼

Prioritizing vulnerabilities found during an API security audit is done by applying threat modeling frameworks like STRIDE and LINDDUN. This categorizes risks by impact, generating a structured report with risk-prioritized remediation steps.