security-review

Identify security gaps in authentication, input handling, secrets, and API endpoints.

1|Updated Oct 17, 2025

Search Tags:#authorization #OWASP #security #authentication #secrets #input-validation

Ready to run

npx skills add https://github.com/tarrragon/claude --skill security-review-tarrragon

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/tarrragon/claude/tree/main/skills/security-review
Command: npx skills add https://github.com/tarrragon/claude --skill security-review-tarrragon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams enforce security best practices across authentication, input handling, secrets management, API endpoints, and payment-related features, reducing vulnerabilities and speeding secure delivery.

Core Features & Use Cases

Comprehensive security checklist covering secrets management, input validation, authorization, data exposure, CSRF, rate limiting, and threat modeling.
Applicable to implementing authentication/authorization, securing APIs, handling secrets, and ensuring safe integration with third-party services.
Real-world use: integrate this skill into CI pipelines to audit new code for secret leakage and insecure patterns.

Quick Start

Use this skill to perform a security review of a new API endpoint by checking secrets handling, input validation, and access controls.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What security checks should I perform on a new API endpoint?▼

Security checks for a new API endpoint should cover secrets handling, input validation, access controls, and data exposure. This skill identifies gaps in these areas and specifies concrete mitigations and secure-by-default patterns.

How do I audit my code for leaked secrets and insecure patterns?▼

You can audit code for leaked secrets by integrating this skill into CI pipelines to review new code for secret leakage and insecure patterns. It checks authentication, input handling, and API endpoints for vulnerabilities.

Does this security review cover authentication and authorization flows?▼

Yes, this security review covers authentication and authorization flows. It applies to implementing authentication/authorization and identifies security gaps in access controls across web and mobile projects.

Can I use this for securing third-party integrations?▼

Yes, you can use this for securing third-party integrations. It ensures safe integration with third-party services by checking secrets management, input validation, and data exposure.

What is the best way to enforce OWASP best practices in a CI pipeline?▼

The best way to enforce OWASP best practices in a CI pipeline is integrating a security checklist that covers secrets management, input validation, CSRF, and rate limiting to audit new code for insecure patterns.

How do I check for input validation and CSRF vulnerabilities in my application?▼

To check for input validation and CSRF vulnerabilities, apply a comprehensive security checklist covering input handling, authorization, and data exposure to specify concrete mitigations and secure-by-default patterns.