agent-security-reviewer

Run a structured review covering the OWASP Top 10: injection, broken authentication, sensitive data exposure, XSS, and misconfiguration. This skill scans for hardcoded secrets, unsafe patterns like string-concatenated SQL, and missing auth checks, returning findings with severity and fixes.

Critical patterns include hardcoded secrets, shell commands built from user input, string-concatenated SQL queries, plaintext password comparison, routes without authentication checks, and balance checks without database locking. Each should be fixed before release.

Yes, it includes commands like npm audit and eslint-plugin-security for dependency and static analysis. The review patterns also apply generally to web applications handling authentication, APIs, and user input regardless of framework.

Run it after writing code that handles user input, authentication, API endpoints, database queries, file uploads, or payments. Also run it immediately after dependency CVEs, production incidents, or before major releases.

Common false positives include placeholder values in .env.example files, clearly marked test credentials, intentionally public API keys, and MD5 or SHA256 used for checksums rather than passwords. Always verify context before treating a finding as a real issue.