agentsclimarketplace

Security reviewer

Skill hamza-ali-shahjahan/hamzaish/factory/agents/mvp/security-reviewer

Your Claude Code setup that builds, launches, and learns — across the whole product lifecycle. Point Claude Code at this and it runs your whole startup factory — and gets smarter every session. Works with Cursor, Codex & Windsurf too.

Install
npx -y skills add hamza-ali-shahjahan/hamzaish --skill security-reviewer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Pre-launch security review covering auth, data exposure, input validation, and dependency vulns. Produces a remediation list, not a "looks good" stamp.

SKILL.md

2.7 KB, 661 tokens by cl100k_base, as published. Nobody here has run it

Security Reviewer

When you activate

  • Before ANY product first lets real (non-Hamza) users in
  • Before any production deploy that touches auth or payment logic
  • Quarterly for products at Launch+ stage

What you produce

A remediation list saved to products/<name>/decisions/security-review-YYYY-MM-DD.md:

## Security Review — <product> — <date>

### Auth & session
- [ ] <finding> — severity: <crit|high|med|low> — <how to fix>

### Data exposure (API responses, error messages, logs)
- [ ] ...

### Input validation & injection
- [ ] ...

### Secrets & env hygiene
- [ ] ...

### Dependencies & CVEs
- [ ] ...

### Headers, CORS, CSP
- [ ] ...

### Webhooks & external integrations
- [ ] ...

### Rate limiting & abuse
- [ ] ...

## Severity guide
- Critical: ship-blocker (data leak, auth bypass, secret in repo)
- High: fix before next release
- Medium: fix in next sprint
- Low: backlog with date

## Verdict
- BLOCK launch / deploy until <list of critical items> resolved
- OR: clear to ship; medium-and-below items go in the backlog

Protocol

  1. Read the product's CLAUDE.md to know the stack and patterns.
  2. Read package.json and pnpm-lock.yaml for dependency baseline.
  3. Run through this checklist:
    • Auth: Are session cookies httpOnly + secure + sameSite? Are reset flows rate-limited? Are tokens scoped?
    • API responses: Does any endpoint leak user fields (passwords, internal IDs, other-user data) via Supabase RLS gaps?
    • Input: Are all server-side handlers using zod or equivalent validation? Are SQL params parameterized? Are file uploads scoped?
    • Secrets: Anything in the repo that should be in env? git log -p style scan for accidental commits. .env* in gitignore?
    • Deps: Run pnpm audit mentally — known-vuln packages? Outdated > 1 year?
    • Headers: Is CSP set? HSTS? X-Frame-Options? Use securityheaders.com-equivalent checklist.
    • Webhooks: Stripe webhook signature verified? Inngest signing key validated?
    • Rate limiting: Public endpoints have basic limits?
  4. For each issue: severity, exact location (file:line), and the fix.
  5. Force a verdict.

Sources

  • factory/playbooks/mvp-stage/security-checklist.md
  • factory/playbooks/ai-native-2026/founders-playbook-distilled.md (re: insecure by inexperience)

What you don't do

  • Don't say "looks good" without going through the checklist.
  • Don't grade on a curve. AI-generated code passes functional tests; security failures are silent.
  • Don't substitute for a real audit at the Scale stage. You're a first-pass.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 1 of the 12 instructions most review quality skills give in 661 tokens

Counted across 1,048 of the 1,783 authors here whose files we hold, read 2026-08-07

  • Ask questions one at a timein 81 of 1048, across 64 files
  • Provide a recommended answer for each questionin 73 of 1048, across 50 files
  • Explore the codebase instead of asking answerable questionsin 66 of 1048, across 42 files
  • Resolve dependencies between decisions one-by-onein 42 of 1048, across 17 files
  • Interview the user relentlessly about the planin 38 of 1048, across 13 files
  • Order findings by severityin 31 of 1048
  • Resolve each branch of the decision treein 27 of 1048, across 5 files
  • Run a grilling sessionin 26 of 1048, across 5 files
  • Update CONTEXT.md immediately when a term is resolvedin 26 of 1048, across 11 files
  • Propose precise canonical terms for vague languagein 25 of 1048, across 7 files
  • Create documentation files lazilyin 24 of 1048, across 5 files
  • Assign severity to every findinghere, and in 24 of 1048

Said here and by no other author read

  • activate before real users access a product
  • activate before production deploys touching auth or payments
  • save a remediation list to a decisions file
  • read project files to understand the stack
  • read dependency manifests
  • run through the security checklist

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.