security-review
Read-only security audit of code for SQL injection, XSS, auth/authz flaws, input validation gaps, sensitive data exposure, and insecure cryptography. Surfaces findings without modifying code.
Works with
--- name: security-review description: Read-only security audit of code for SQL injection, XSS, auth/authz flaws, input validation gaps, sensitive data exposure, and insecure cryptography. Surfaces findings without modifying code. license: MIT --- # Security Code Review This skill is **explicit-invoke only** (`disable-model-invocation: true`) and **read-only** (`allowed-tools` covers reading + searching, no editing). It surfaces findings — fixing them is a separate, deliberate step. ## Categories to check - **Injection**: SQL, NoSQL, OS command, LDAP, XPath, template - **XSS**: reflected, stored, DOM-based; encoding context (HTML body vs. attribute vs. JS context) - **AuthN / AuthZ**: missing checks, broken object-level authorization, privilege escalation - **Input validation**: trust boundaries, type confusion, deserialization - **Sensitive data exposure**: secrets in code, tokens in logs, PII in error responses, weak hashing - **Cryptography**: hardcoded keys, ECB mode, weak algorithms (MD5/SHA-1 for security), missing IV randomness ## Output For each finding, report: 1. **File and line** (Path:Line format so the user can jump to it) 2. **Severity** (critical / high / medium / low / informational) 3. **What's wrong** 4. **What an attack would look like** 5. **A recommended fix direction** (not the actual code change — that's a separate skill) Group findings by severity. Don't speculate about issues you can't see in the code; if a check requires runtime context you don't have, say so.
More Code Review skills
pr-to-video
heygen-com/hyperframes
Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR topic explainer (/faceless-explainer). Unclear → /hyperframes.
receiving-code-review
obra/superpowers
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
public-relations
coreyhaines31/marketingskills
When the user wants help with public relations, earned media, press coverage, journalist outreach, or media strategy (not pull requests). Also use when the user mentions 'PR,' 'public relations,' 'press,' 'press release,' 'press coverage,' 'media outreach,' 'pitch a journalist,' 'get featured,' 'media list,' 'media kit,' 'press kit,' 'newsjacking,' 'news hijack,' 'HARO,' 'Qwoted,' 'Featured,' 'Help A Reporter,' 'reporter request,' 'tech press,' 'TechCrunch,' 'earned media,' 'thought leadership placement,' 'op-ed,' 'guest article,' 'press contacts,' 'podcast prep,' 'going on a podcast,' 'podcast guest,' 'prep me for this podcast,' or 'how do I get press.' Use this for earned media work — finding journalists, pitching stories, newsjacking, prepping podcast appearances, and responding to press requests. For startup/SaaS/AI directory submissions, see directory-submissions. For product launches, see launch. For social-media engagement, see social. For cold-email outreach to prospects, see cold-email.
