Api and infrastructure

Skill JeremyMorgan/code-review-skills/skills/api-and-infrastructure

Reviews API and infrastructure security configuration, including endpoints, headers, transport, and deployment settings. Use when auditing API or infrastructure hardening.From its SKILL.md

Install

npx -y skills add JeremyMorgan/code-review-skills --skill api-and-infrastructure

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.2 KB, as published. Nobody here has run it

Target: $ARGUMENTS

If no target path is given above, review the entire codebase.

API & Infrastructure Security

Review API-specific security configurations.

Check for:

CORS configuration
- Not using wildcard (*) in production
- Proper origin validation
- Credentials handling
Rate Limiting
- Implemented on all endpoints
- Different limits for different operations
- Distributed rate limiting for scaled apps
API Versioning security
- Deprecated version handling
- Breaking change management
Request size limits
- Body parser limits
- File upload restrictions
- JSON depth limits
HTTP Security Headers
- Helmet.js configuration
- CSP headers
- X-Frame-Options
- X-Content-Type-Options
- Strict-Transport-Security
API key/token management
- Secure storage
- Rotation policy
- Scope limitations
Error handling
- No stack traces in production
- Generic error messages
- Proper status codes

Provide:

A structured finding report with the following for each issue:

Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.

Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).

Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.

A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.

A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.

Constraints & style:

Be concrete and cite exact code locations and identifiers.

Prefer minimal, drop-in fix snippets over prose.

Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.

Write this into a markdown file and place it in the audits/ folder.