security-review

The security-review skill is designed to help developers ensure that their code adheres to established security best practices and to identify potential vulnerabilities before deployment. It systematically guides users through common security pitfalls, such as hardcoded secrets, unsanitized user input, insecure file handling, and improper authentication mechanisms. By providing a structured framework for evaluating code, this skill helps prevent security breaches and protects sensitive data from unauthorized access or exploitation.

The skill includes comprehensive features for secrets management, input validation, SQL injection prevention, and authentication and authorization. For secrets management, it enforces storing credentials in environment variables and verifying their presence, avoiding hardcoding sensitive data. Input validation ensures that all user input, including file uploads, is properly checked against defined schemas and whitelisted rules. SQL injection prevention is addressed through parameterized queries and proper use of ORMs or query builders. Authentication and authorization guidance covers secure handling of tokens and enforcement of proper access controls.

This skill is particularly useful for software developers, DevOps engineers, and security auditors who work on web applications, API development, or systems handling sensitive information. It is applicable whenever authentication, payment processing, third-party integrations, or sensitive data storage are involved. By following the guidelines and verification steps provided, users can reduce security risks, comply with best practices, and deliver more secure applications to end users.