skills.rest
Boulea7
Boulea7COMMUNITY
Explore all skills by this author →
GitHub

security-review

Reviews code changes for authentication, secrets, permissions, and input validation risks.

Updated Dec 1, 2025
Search Tags:#code review#authentication#vulnerability#input validation#permissions#security review#secrets
One-click install
npx skills add https://github.com/Boulea7/ohmyclaude --skill security-review-boulea7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Boulea7/ohmyclaude/tree/main/src/ohmyclaude/templates/skills/security-review
Command: npx skills add https://github.com/Boulea7/ohmyclaude --skill security-review-boulea7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Code changes that touch authentication, secrets, permissions, or external input can silently introduce security regressions, and ad-hoc reviews often miss critical trust boundaries or unsafe defaults. ## Core Features & Use Cases - Prioritized Review Scope: Focuses analysis on authentication and authorization, secret handling, input validation, file and shell safety, and network boundaries. - Structured Checklist: Walks through trust boundary identification, permission scope checks, secret exposure detection, validation ordering, and missing security tests. - Actionable Output: Produces findings ordered by severity, residual risks, and recommended fixes. - Use Case: Before merging a pull request that adds a new API endpoint accepting user input, run this review to verify input validation happens before side effects and no secrets leak into logs. ## Quick Start Review the changes in this pull request for security issues covering auth, secrets, permissions, and input handling.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code changes for security vulnerabilities?▼

Identify trust boundaries and attacker-controlled inputs first, then check permissions, secret handling, and input validation ordering. This Skill provides a checklist covering auth, secrets, file and shell safety, and network boundaries, with findings ordered by severity.

What should a security code review checklist include?▼

A security review checklist should cover authentication and authorization, secret handling, input validation, file and shell safety, and network boundaries. It should also verify validation happens before side effects and that critical security behavior has tests.

When should I run a security review on a pull request?▼

Run a security review whenever a change touches authentication, secrets, permissions, external input handling, or third-party integrations. These areas carry the highest risk of introducing regressions that standard functional review may miss.

What are the limitations of a checklist-based security review?▼

A checklist-based review relies on the reviewer's judgment and cannot execute code, run penetration tests, or detect runtime vulnerabilities. It complements but does not replace automated scanners, fuzzing, or dedicated security testing.

Related Skills

Explore More Software Engineering Skills→
shhubbhshhubbh
1

review

Analyze pull request diffs for SQL safety, LLM trust boundaries, and side effects.

Community
Advanced
enigmaicon-engenigmaicon-eng
1

test-master

Generate test strategies and reports for functional, performance, and security coverage.

Community
Intermediate
HomericIntelligenceHomericIntelligence
18

scan-vulnerabilities

Scan code and dependencies for security vulnerabilities using Bandit, Safety, and Semgrep.

Official
Intermediate
EntroVyxEntroVyx
3

exploit-chaining-engine

Analyze and prioritize security findings for exploit chain potential.

Community
Advanced