---
name: Security Review
slug: security-review
category: Quality
description: Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.
github: "https://github.com/iCodeCraft/anti-slop/tree/main/skills/security-review"
language: Shell
stars: 25
forks: 2
install: "npx degit https://github.com/iCodeCraft/anti-slop/tree/main/skills/security-review ~/.claude/skills/security-review"
installs_to: ~/.claude/skills/security-review
source_path: skills/security-review/SKILL.md
collection_size: 3
category_size: 1354
collection_url: "https://dirskills.com/collections/iCodeCraft/anti-slop"
added: 2026-08-11T07:22:01.164Z
last_synced: 2026-08-11T07:22:01.164Z
canonical_url: "https://dirskills.com/skills/security-review"
---

# Security Review

Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.

**Install:**

```bash
npx degit https://github.com/iCodeCraft/anti-slop/tree/main/skills/security-review ~/.claude/skills/security-review
```

## README

# Security Review

Review the current change like a security-minded senior. Prefer concrete findings over generic advice.

## Scope

Focus on the diff and directly related call paths. Do not audit the whole repo unless asked.

## Checklist

### Auth & access

- [ ] Every sensitive action checks authentication **and** authorization
- [ ] IDs from the client are not trusted for ownership (`userId` in body ≠ proof)
- [ ] Admin/debug routes are gated; no "temporary" open endpoints

### Input & data

- [ ] User input is validated at the boundary (type, length, allowlist)
- [ ] SQL/NoSQL/search queries are parameterized — no string concat
- [ ] HTML/Markdown/user content is escaped or sanitized where rendered
- [ ] File uploads: size limits, type allowlist, stored outside web root, randomized names
- [ ] Path joins cannot escape intended directories (`../`)

### Secrets & config

- [ ] No secrets in source, logs, client bundles, or example env files with real values
- [ ] New env vars documented; defaults are safe for production
- [ ] Tokens/passwords not written to analytics or error trackers

### Network & server

- [ ] Outbound fetches do not accept raw user URLs without allowlisting (SSRF)
- [ ] CORS is least-privilege; credentials only when required
- [ ] Cookies: `HttpOnly`, `Secure`, `SameSite` where applicable

### Dangerous APIs

- [ ] No `eval`, `dangerouslySetInnerHTML`, shell `exec` with unsanitized input
- [ ] Deserialization of untrusted data is avoided or hardened
- [ ] Crypto/auth libraries are standard — no home-rolled JWT/crypto

## Output format

Group findings:

| Severity | Rule | Where | Why it matters | Fix |
|----------|------|-------|----------------|-----|
| Critical / High / Medium / Low / Note | short name | `file:line` or symbol | 1 sentence | concrete change |

End with:

- **Blockers** — must fix before merge
- **Safe to ship with follow-ups** — optional

If no issues: say so explicitly and list what you checked.