security-review

Guide security reviews using the OWASP Top 10 checklist for web applications and APIs.

Updated Dec 1, 2025
One-click install
npx skills add https://github.com/tadokoro-ryusuke/cc-plugins --skill security-review-tadokoro-ryusuke
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/tadokoro-ryusuke/cc-plugins/tree/main/dev-core/skills/security-review
Command: npx skills add https://github.com/tadokoro-ryusuke/cc-plugins --skill security-review-tadokoro-ryusuke

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill guides users through a comprehensive OWASP Top 10 checklist and related security considerations to identify and discuss security risks in applications.

Core Features & Use Cases

  • OWASP Top 10 alignment: Provides a structured checklist covering A01-A10 with practical checks for access control, cryptography, injection, insecure design, misconfiguration, vulnerable components, authentication failures, software integrity, logging, and server-side request forgery.
  • Guided assessment workflows: Works for code reviews, architecture reviews, and security risk assessments across web apps and APIs.
  • Actionable guidance: Delivers concrete remediation recommendations and prioritization guidance to help teams fix critical issues.
  • Use Case: For example, during a new API development, run the checklist to verify proper authentication, authorization, data protection, and secure error handling, then document findings.

Quick Start

Guide me through a security review of a web application following the OWASP Top 10 and provide prioritized remediation guidance.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an OWASP Top 10 security review for my web application?

An OWASP Top 10 security review systematically checks your web application against vulnerabilities like access control failures, injection, and cryptographic flaws. This skill guides you through a structured checklist covering A01-A10 to identify and triage security risks.

What is threat modeling and secure code review in API development?

Secure code review and threat modeling in API development involve verifying proper authentication, authorization, data protection, and secure error handling. This skill provides actionable remediation guidance by assessing your API against established security best practices.

Can I use an OWASP checklist for architecture reviews and risk assessments?

Yes, an OWASP checklist is applicable for architecture reviews and security risk assessments. It guides users through evaluating insecure design, misconfiguration, and vulnerable components to produce exportable findings for development teams.

How do I fix authorization and authentication failures in my code?

To fix authorization and authentication failures, you need concrete remediation recommendations and prioritization guidance. This skill identifies access control vulnerabilities and delivers actionable steps to help teams resolve critical security issues.

What is the best way to check for server-side request forgery and insecure design?

The best way to check for server-side request forgery and insecure design is using a structured OWASP-based checklist. This skill systematically evaluates software integrity, logging failures, and misconfiguration to identify and triage security risks.