security-review

Apply a structured security checklist to code changes for vulnerabilities.

12|4|Updated Mar 14, 2026

Search Tags:#checklist #authorization #security #authentication #vulnerability #api-security #code-review

Ready to run

npx skills add https://github.com/mshadmanrahman/pm-pilot --skill security-review-mshadmanrahman

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/mshadmanrahman/pm-pilot/tree/main/skills/dev/security-review
Command: npx skills add https://github.com/mshadmanrahman/pm-pilot --skill security-review-mshadmanrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a systematic, end-to-end security checklist to identify and remediate vulnerabilities in code changes before they ship, reducing risk in software delivery.

Core Features & Use Cases

Scope-based checks: determines applicable checks based on modified files (auth, API, input handling, secrets, config).
Comprehensive checklist: covers hardcoded secrets, SQL/NoSQL injection, auth bypass, XSS/CSRF, input validation, rate limiting, error leakage, authorization checks, and dependency vulnerabilities.
Structured reporting & blocking rules: enforces clear severity-based reporting, required fixes, and merge blockers for critical findings.
Use Case: use this during code review of a new feature or bugfix touching security-sensitive areas to ensure no vulnerabilities are introduced.

Quick Start

Start by applying a structured security checklist to any commit that changes authentication, authorization, or API endpoints.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security vulnerabilities in code changes before merging?▼

To identify security vulnerabilities in code changes, apply a structured security checklist covering authentication, authorization, API endpoints, secrets handling, and configuration to systematically detect and remediate risks before shipping.

What does an end-to-end security code review cover?▼

An end-to-end security code review covers hardcoded secrets, SQL/NoSQL injection, auth bypass, XSS/CSRF, input validation, rate limiting, error leakage, and dependency vulnerabilities based on modified file scope.

How can I automate security checks for modified API endpoints during code review?▼

Automate security checks for modified API endpoints by enforcing scope detection on code changes, triggering stepwise checklist execution and code scanning commands to validate input handling, rate limiting, and authorization.

Can I block code merges based on the severity of security findings?▼

You can block code merges based on security findings by enforcing clear blocking rules that require fixes for standardized, severity-based reports of critical vulnerabilities discovered during the code review.

Does scope-based security checking work for infrastructure configuration changes?▼

Scope-based security checking works for infrastructure configuration changes by determining applicable checks based on modified files, ensuring any change touching configuration or infrastructure undergoes targeted vulnerability scanning.