skills.rest
ibytechaos
ibytechaosCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Reviews code against security checklists covering secrets, injection, XSS, CSRF, and authentication.

1|Updated Oct 11, 2025
Search Tags:#checklist#authentication#vulnerability#input validation#owasp#security review#cloud security
One-click install
npx skills add https://github.com/ibytechaos/claude --skill security-review-ibytechaos
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/ibytechaos/claude/tree/main/plugins/everything-claude-code/skills/security-review
Command: npx skills add https://github.com/ibytechaos/claude --skill security-review-ibytechaos

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It prevents common vulnerabilities from reaching production by giving you a structured security checklist and concrete code patterns whenever you build authentication, handle user input, manage secrets, or create API endpoints. ## Core Features & Use Cases - Ten-Area Security Checklist: Covers secrets management, input validation, SQL injection, authentication/authorization, XSS, CSRF, rate limiting, sensitive data exposure, blockchain security, and dependency auditing, each with wrong-vs-right TypeScript examples. - Cloud Infrastructure Security Reference: Extends review to IAM least privilege, secrets rotation, VPC/firewall rules, CI/CD pipeline hardening, Cloudflare WAF, and backup/disaster recovery. - Pre-Deployment Gate: Provides a final checklist to run before any production release, plus automated security test examples for auth, validation, and rate limits. - Use Case: Before shipping a new payment endpoint, run the checklist to confirm inputs are validated with Zod, queries are parameterized, tokens live in httpOnly cookies, and rate limiting is enabled. ## Quick Start Review my new API endpoint code for security issues using the security checklist and flag anything that fails.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for security vulnerabilities before deployment?▼

Run through a structured checklist covering secrets management, input validation, SQL injection, XSS, CSRF, authentication, and rate limiting. Verify each item with concrete checks like confirming no hardcoded API keys and that all queries use parameterized statements.

How to prevent SQL injection in Node.js applications?▼

Always use parameterized queries or an ORM instead of string concatenation. For example, pass user input as a bound parameter like db.query('SELECT * FROM users WHERE email = $1', [email]) rather than interpolating values into the SQL string.

Should JWT tokens be stored in localStorage or cookies?▼

Store tokens in httpOnly cookies, not localStorage, because localStorage is accessible to JavaScript and vulnerable to XSS theft. Set the cookie with HttpOnly, Secure, and SameSite=Strict flags for protection.

Does this security checklist cover cloud infrastructure like AWS?▼

Yes, a companion reference covers IAM least privilege, secrets manager rotation, security group restrictions, CloudWatch logging, CI/CD pipeline hardening with OIDC, Cloudflare WAF rules, and automated backup configuration.

What are the limitations of a checklist-based security review?▼

A checklist catches common vulnerability classes but cannot replace penetration testing or automated scanning tools. It relies on the reviewer applying each item correctly and does not detect novel or business-logic-specific flaws.

Related Skills

Explore More Software Engineering Skills→
bytetalentbytetalent

API Route Conventions

Enforces RESTful API route conventions for Next.js apps with Clerk and Supabase.

Official
Intermediate
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced