skills.rest
Tgoldi
TgoldiCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Reviews code against a security checklist covering secrets, input validation, authentication, and injection prevention.

1|Updated May 10, 2026
Search Tags:#authentication#vulnerability#input validation#sql injection#owasp#security review#xss prevention
One-click install
npx skills add https://github.com/Tgoldi/claude-skills --skill security-review-tgoldi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Tgoldi/claude-skills/tree/main/security-review
Command: npx skills add https://github.com/Tgoldi/claude-skills --skill security-review-tgoldi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Developers shipping authentication, payment, or user-input features often miss vulnerabilities like hardcoded secrets, SQL injection, or missing authorization checks. This Skill provides a structured security checklist with concrete code patterns to catch these issues before deployment. ## Core Features & Use Cases - Ten-Domain Security Checklist: Covers secrets management, input validation, SQL injection, authentication/authorization, XSS, CSRF, rate limiting, sensitive data exposure, blockchain security, and dependency vulnerabilities. - Do/Don't Code Patterns: Provides concrete TypeScript, Next.js, and Supabase examples showing vulnerable code alongside the correct secure implementation. - Pre-Deployment Gate: A final checklist to run before any production release, plus automated security test examples for auth, validation, and rate limiting. - Use Case: When adding a new API endpoint that accepts file uploads, activate this Skill to validate file size/type, parameterize queries, enforce rate limits, and verify authorization checks. ## Quick Start Review my new API endpoint code for security vulnerabilities using the security checklist.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Node.js applications?▼

Prevent SQL injection by always using parameterized queries instead of string concatenation. With Supabase, use query builder methods like .eq(), and with raw SQL pass values as parameters, e.g. db.query('SELECT * FROM users WHERE email = $1', [email]).

How to validate user input in TypeScript APIs?▼

Validate user input with Zod schemas that define expected types, formats, and ranges, then call schema.parse() before processing. For file uploads, also check size limits, MIME types, and file extensions using a whitelist approach.

Should I store JWT tokens in localStorage or cookies?▼

Store tokens in httpOnly cookies, not localStorage, because localStorage is vulnerable to XSS attacks. Set cookies with HttpOnly, Secure, and SameSite=Strict flags to prevent client-side script access and CSRF risks.

Does Supabase Row Level Security replace authorization checks?▼

Row Level Security enforces data access at the database level but should complement, not replace, application-level authorization checks. Enable RLS on all tables with policies like auth.uid() = id, and still verify roles before sensitive operations.

What security checks should run before production deployment?▼

Verify no hardcoded secrets, validated inputs, parameterized queries, sanitized user content, CSRF protection, rate limiting, HTTPS enforcement, security headers, clean npm audit results, and enabled Row Level Security. Generic error messages should hide internal details from users.

Related Skills

Explore More Software Engineering Skills→
clfigueiredoclfigueiredo
5

security-review

Reviews code against a security checklist covering secrets, input validation, authentication, and injection prevention.

Community
Intermediate
arbazkhan971arbazkhan971
26

legacy

Modernize legacy codebases with characterization tests, dead-code removal, and dependency upgrades.

Community
Advanced
AsiaOstrichAsiaOstrich
70

discover

Assess project health, architecture, and risks in existing codebases.

Community
Intermediate
arcasilesgrouparcasilesgroup
54

ai-security

Run unified security scans for SAST, DAST, dependencies, and SBOM generation.

Official
Advanced