Security review

Skill openagentskills/betterskills/skills/engineering/security-review

Portable, open catalogue of agent skills for Cursor, Claude Code, Windsurf, Copilot, and other AI coding assistants.

Install

npx -y skills add openagentskills/betterskills --skill security-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Performs a lightweight security review using OWASP-oriented checks for auth, input validation, secrets, and dependencies. Use for security review, threat check, or before merging sensitive changes.

SKILL.md

1.7 KB, as published. Nobody here has run it

Security Review

Scope

Focus on changed code and its trust boundaries (network, auth, data stores, third parties).

Checklist

Authentication & session

Auth required on all non-public routes
Session/token expiry and rotation considered
Logout invalidates server-side session if applicable

Authorization

Object-level checks (user A cannot access user B's resource)
Role checks on admin paths
No security by obscurity

Input & output

Parameterized queries (no string-built SQL)
Output encoded for context (HTML, URL, JS)
File uploads: type, size, storage path validated
SSRF protections on outbound fetches

Secrets & crypto

No secrets in repo, logs, or client code
Passwords hashed with modern algorithm (argon2/bcrypt)
TLS for data in transit

Dependencies & config

New dependencies justified; note supply-chain risk
Debug endpoints disabled in production
CORS not * with credentials

Output format

## Security review summary
Risk: [Low / Medium / High]

## Findings
| Severity | Location | Issue | Recommendation |
|----------|----------|-------|----------------|
| High | file:line | ... | ... |

## Residual risk
[What was not reviewed or needs pentest]

Severity

High: Exploitable without unlikely conditions
Medium: Requires misconfiguration or chained issues
Low: Defense-in-depth improvement

Do not claim compliance (SOC2, PCI) — flag for human auditors.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.