---
name: security-review-skill
description: "OWASP-aware code security audit — finds auth, input, secret, and dependency issues with remediation. Runs a structured security review on the current diff: OWASP Top 10 patterns, auth/authz issues, input validation gaps, secret leaks, dependency CVEs. Outputs findings ranked by severity with concrete fix code."
license: MIT
---

# Security Review

Security Review runs a structured, OWASP-aware audit over your uncommitted changes and flags the vulnerabilities a human reviewer tends to miss under deadline: broken access control, injection, leaked secrets, and known-vulnerable dependencies. It reads the actual diff rather than scanning the whole tree, so feedback stays scoped to what you're about to ship. Built for backend and full-stack engineers, QA, and anyone who owns the review gate on a SaaS codebase.

## When to use it

- Right before opening or merging a PR, as a self-review pass on the branch diff.
- After adding an auth flow, a new API route, a file upload, or a raw SQL query.
- When you pull in a new dependency and want a quick CVE sanity check.
- During incident hardening, to sweep recently touched code for the same class of bug.

## What it does

The skill collects the working diff (staged and unstaged against the branch base) and reviews each changed hunk against a security checklist derived from the OWASP Top 10:

- **Access control** — missing authorization checks, IDOR, routes that trust client-supplied IDs or roles.
- **Injection** — string-built SQL/NoSQL/shell/LDAP queries, unescaped template output, unsafe deserialization.
- **Secrets** — hardcoded API keys, tokens, private keys, and connection strings introduced in the diff.
- **Input validation** — unbounded input, missing allow-lists, SSRF-prone URL fetches, path traversal.
- **Dependencies** — new or bumped packages in `package.json`, `requirements.txt`, `go.mod`, etc., cross-checked for known CVEs.

Each finding is ranked Critical / High / Medium / Low, cites the file and line, explains the exploit path, and includes a concrete fix — usually a corrected code snippet, not just advice.

## Usage

```bash
# install once
curl -fsSL --create-dirs -o ~/.claude/skills/security-review-skill/SKILL.md https://claudeskil.com/skills/security-review-skill/SKILL.md

# stage your work, then run the review on the current branch
git add -A
/security-review
```

Output is a severity-ordered report, for example:

```
HIGH  src/api/orders.ts:42  Broken access control (IDOR)
  Order is fetched by req.params.id with no ownership check.
  Fix: if (order.userId !== req.user.id) return res.status(403)...
```

## Tips & gotchas

- It reviews the **diff**, not the whole repo — pre-existing issues in untouched files won't surface. Run it on the branch where the code was introduced.
- Stage or commit your changes first; an empty diff yields an empty report.
- Dependency CVE matching reflects the model's knowledge cutoff. Treat it as a first pass and keep `npm audit` / `pip-audit` in CI for authoritative results.
- Severity is contextual, not absolute — a "High" in an internal tool may be lower risk than in a public endpoint. Use it to triage, not to gate blindly.

## FAQ

**Does this replace SAST tools like Snyk or CodeQL?** No. It's a fast, context-aware review at code-write time. Keep your scanners in CI for coverage and compliance.

**Can it review an entire codebase?** It's optimized for diffs. For a full audit, review module by module rather than one giant pass.

**Will it modify my code?** No. It only reports findings and suggested fixes; you apply the changes.