skills.rest
Iron-Mark
Iron-MarkCOMMUNITY
Explore all skills by this author →
GitHub

security-reviewer

Reviews diffs in app/api and lib for SSRF, auth, secret handling, and trust UX.

6|4|Updated Apr 25, 2026
Search Tags:#security review#test coverage#ssrf#secrets handling#auth validation#api code review#pr guardrails
One-click install
npx skills add https://github.com/Iron-Mark/Hackathon-HireProof --skill security-reviewer-iron-mark
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-reviewer
Source: https://github.com/Iron-Mark/Hackathon-HireProof/tree/main/.cursor/skills/security-reviewer
Command: npx skills add https://github.com/Iron-Mark/Hackathon-HireProof --skill security-reviewer-iron-mark

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents security regressions when reviewing HireProof API and core logic diffs that could introduce vulnerabilities or weaken existing guardrails.

Core Features & Use Cases

  • Deterministic PR/security review guidance: Focuses on SSRF, auth, secret handling, and trust UX issues in changes under app/api and lib.
  • Repo-aware rule enforcement: Directs reviewers to apply the versioned Bugbot rules and stay within scope rather than inventing new policies.
  • Change-management coverage: Ensures API and core logic behavior changes are paired with the expected test updates.

Quick Start

Ask the AI to perform a security-focused review of the PR diff limited to files under app/api/** and lib/**, using the repo’s Bugbot rules and checking SSRF, auth, secrets, and evidence provenance in user-facing trust UX.

Frequently Asked Questions about security-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on API code changes to prevent regressions?▼

Perform a security review by analyzing PR diffs in app/api and lib directories, checking SSRF validation, auth rate limiting, strict secret handling, honest demo trust UX, and verifying corresponding test updates. Apply repo Bugbot rules to stay within scope.

What SSRF and auth validation checks should I run during an API security review?▼

SSRF and auth validation checks must verify URL validation with timeouts, enforce auth origin/referrer restrictions and rate limiting, and maintain strict secret handling. Validate honest demo versus live trust UX in user-facing components during the API security review.

Does this security review guidance enforce existing repo rules or create new policies?▼

The security review guidance enforces existing versioned Bugbot rules rather than inventing new policies. It directs reviewers to stay within scope and apply established guardrails to prevent security regressions in app/api and lib changes.

How do I ensure test coverage matches behavior changes in core logic security updates?▼

Ensure test coverage by requiring corresponding test updates for any behavior changes in app/api and lib. The security review validates that API and core logic modifications are paired with expected test updates to prevent regressions.

Can I use this to review trust UX and evidence provenance in user-facing API diffs?▼

Yes, you can review trust UX and evidence provenance by checking user-facing components for honest demo versus live trust interactions. The security review validates that changes under app/api maintain strict trust UX standards.

When should I not use an automated security review for PR guardrails?▼

You should not use automated security review for PR guardrails when diffs do not touch app/api or lib directories. The review is scoped to API and core logic changes and stays within established Bugbot rules rather than inventing new policies.

Related Skills

Explore More Software Engineering Skills→
masermediagroup-stackmasermediagroup-stack
1

security-review

Identify and remediate security vulnerabilities in code, configuration, and dependencies.

Community
Advanced
apassuelloapassuello

automating-api-testing

Generate and execute API tests for REST and GraphQL endpoints.

Community
Intermediate
OzeroHAXOzeroHAX
32

coder-system-design-external-api

Design resilient external API integrations with timeouts, retries, and credential management.

Community
Advanced
lamb92009lamb92009

security-reviewer

Identify vulnerabilities in code, configurations, and infrastructure with prioritized remediation guidance.

Community
Advanced