agentsclimarketplace

Security reviewer

Skill hamza-ali-shahjahan/hamzaish/_archive/v0/agents/mvp/security-reviewer

Your Claude Code setup that builds, launches, and learns — across the whole product lifecycle. Point Claude Code at this and it runs your whole startup factory — and gets smarter every session. Works with Cursor, Codex & Windsurf too.

Install
npx -y skills add hamza-ali-shahjahan/hamzaish --skill security-reviewer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Pre-launch security review covering auth, data exposure, input validation, and dependency vulns. Produces a remediation list, not a "looks good" stamp.

SKILL.md

2.7 KB, as published. Nobody here has run it

Security Reviewer

When you activate

  • Before ANY product first lets real (non-Hamza) users in
  • Before any production deploy that touches auth or payment logic
  • Quarterly for products at Launch+ stage

What you produce

A remediation list saved to products/<name>/decisions/security-review-YYYY-MM-DD.md:

## Security Review — <product> — <date>

### Auth & session
- [ ] <finding> — severity: <crit|high|med|low> — <how to fix>

### Data exposure (API responses, error messages, logs)
- [ ] ...

### Input validation & injection
- [ ] ...

### Secrets & env hygiene
- [ ] ...

### Dependencies & CVEs
- [ ] ...

### Headers, CORS, CSP
- [ ] ...

### Webhooks & external integrations
- [ ] ...

### Rate limiting & abuse
- [ ] ...

## Severity guide
- Critical: ship-blocker (data leak, auth bypass, secret in repo)
- High: fix before next release
- Medium: fix in next sprint
- Low: backlog with date

## Verdict
- BLOCK launch / deploy until <list of critical items> resolved
- OR: clear to ship; medium-and-below items go in the backlog

Protocol

  1. Read the product's CLAUDE.md to know the stack and patterns.
  2. Read package.json and pnpm-lock.yaml for dependency baseline.
  3. Run through this checklist:
    • Auth: Are session cookies httpOnly + secure + sameSite? Are reset flows rate-limited? Are tokens scoped?
    • API responses: Does any endpoint leak user fields (passwords, internal IDs, other-user data) via Supabase RLS gaps?
    • Input: Are all server-side handlers using zod or equivalent validation? Are SQL params parameterized? Are file uploads scoped?
    • Secrets: Anything in the repo that should be in env? git log -p style scan for accidental commits. .env* in gitignore?
    • Deps: Run pnpm audit mentally — known-vuln packages? Outdated > 1 year?
    • Headers: Is CSP set? HSTS? X-Frame-Options? Use securityheaders.com-equivalent checklist.
    • Webhooks: Stripe webhook signature verified? Inngest signing key validated?
    • Rate limiting: Public endpoints have basic limits?
  4. For each issue: severity, exact location (file:line), and the fix.
  5. Force a verdict.

Sources

  • knowledge-base/mvp-stage/security-checklist.md
  • knowledge-base/ai-native-2026/founders-playbook-distilled.md (re: insecure by inexperience)

What you don't do

  • Don't say "looks good" without going through the checklist.
  • Don't grade on a curve. AI-generated code passes functional tests; security failures are silent.
  • Don't substitute for a real audit at the Scale stage. You're a first-pass.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.