---
name: Security Review
slug: security-review-3
category: Quality
description: Security Review invokes a security expert to assess code changes that affect process spawning, file access, config loading, or environment handling. Use it when reviewing MCP-LSP bridge changes with security-sensitive behavior.
github: "https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review"
language: TypeScript
stars: 673
forks: 51
install: "npx degit https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review ~/.claude/skills/security-review"
installs_to: ~/.claude/skills/security-review
source_path: .claude/skills/security-review/SKILL.md
collection_size: 4
category_size: 1354
collection_url: "https://dirskills.com/collections/ktnyt/cclsp"
added: 2026-08-24T05:16:36.581Z
last_synced: 2026-08-24T05:16:36.581Z
canonical_url: "https://dirskills.com/skills/security-review-3"
---

# Security Review

Security Review invokes a security expert to assess code changes that affect process spawning, file access, config loading, or environment handling. Use it when reviewing MCP-LSP bridge changes with security-sensitive behavior.

**Install:**

```bash
npx degit https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review ~/.claude/skills/security-review
```

## README

# Security Review

Invoke the security-reviewer agent to assess security-sensitive changes.

## When to trigger

- Child process spawning or lifecycle changes (`src/lsp-client.ts`)
- File system read/write operations (`src/file-editor.ts`, `src/file-scanner.ts`)
- Configuration file loading or parsing (`cclsp.json`, `CCLSP_CONFIG_PATH`)
- Environment variable handling
- New or modified LSP server adapter (`src/lsp/adapters/`)
- Setup wizard input handling (`src/setup.ts`)

## Review checklist

1. **Command injection**: Are user-supplied values (config file paths, server
   commands) sanitized before being passed to `child_process` spawn?
2. **Path traversal**: Can file paths from LSP responses escape the project
   root? Are `file://` URIs validated before resolving?
3. **Resource exhaustion**: Are there timeouts on LSP server responses? Can a
   malicious LSP server cause unbounded memory growth?
4. **Config trust boundary**: Is `cclsp.json` treated as trusted input? What
   happens if it contains unexpected fields or types?
5. **Process cleanup**: Are child processes reliably terminated on shutdown?
   Can orphaned processes persist?
6. **Symlink attacks**: Does file resolution follow symlinks outside the
   project directory?

## How to invoke

Use the `everything-claude-code:security-reviewer` agent via the Task tool:

```
Task(
  subagent_type: "everything-claude-code:security-reviewer",
  prompt: "Review the following changes for security concerns: <describe changes>"
)
```

## Output expectations

The security reviewer should produce:

- **CRITICAL**: Must fix before merge (injection, traversal, credential leak)
- **HIGH**: Should fix before merge (missing timeouts, incomplete cleanup)
- **MEDIUM**: Fix when possible (defensive checks, hardening opportunities)
- **LOW**: Informational (best practice suggestions)