skills.rest
Sambalicious
SambaliciousCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Review full-stack code for security vulnerabilities using a YAML checklist.

Updated Sep 13, 2025
Search Tags:#authorization#security#authentication#input-validation#api-security#secrets-management#secure-coding
One-click install
npx skills add https://github.com/Sambalicious/express-typescript-starter --skill security-review-sambalicious
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Sambalicious/express-typescript-starter/tree/main/.agents/skills/security-review/agents
Command: npx skills add https://github.com/Sambalicious/express-typescript-starter --skill security-review-sambalicious

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill ensures all code follows security best practices and identifies potential vulnerabilities, focusing on authentication, input handling, secrets, API endpoints, and payment-related features, with a comprehensive security checklist and patterns.

Core Features & Use Cases

  • Security checklist covering secrets management, input validation, SQL injection prevention, authentication & authorization, XSS, CSRF, rate limiting, and data exposure controls.
  • Practical code examples, verification steps, and guidance for secure design, implementation, and reviews across full-stack projects.
  • Use cases include securing new API endpoints, integrating third-party services, and protecting sensitive data in transit and at rest.

Quick Start

Run the security checklist on a new API endpoint to verify compliance.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on new API endpoints?▼

Run a security review on API endpoints by applying a comprehensive checklist that verifies authentication, input validation, rate limiting, and data exposure controls to ensure compliance with secure coding practices.

What is the best way to prevent SQL injection and XSS during code reviews?▼

Preventing SQL injection and XSS during code reviews involves applying codified secure design patterns and verification steps that validate input handling and enforce secure coding practices across full-stack projects.

How does secret rotation and secrets management work in secure coding?▼

Secrets management and rotation in secure coding involves applying defined patterns and practical verification steps to protect sensitive data in transit and at rest across full-stack development scenarios.

Can I use this security checklist for third-party service integrations?▼

Yes, this security checklist applies to third-party service integrations by providing verification steps and secure design patterns to enforce access control and protect sensitive data during full-stack development.

What security checks are needed for user authentication flows?▼

Security checks for user authentication flows include verifying authorization, access control, and secure design patterns using a comprehensive checklist that codifies practical verification steps and reusable examples.

Are there limitations to using a checklist for securing payment-related features?▼

Securing payment-related features with a checklist codifies patterns and verification steps, but developers must manually implement the executable snippets and adapt the secure design patterns to their specific full-stack environment.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate