Agent skill · security · affaan-m
security-review
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
Why this skill is useful
Provides a comprehensive security checklist and patterns for authentication, input validation, and sensitive data handling that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Security Review Skill This skill ensures all code follows security best practices and identifies potential vulnerabilities. When to Activate Implementing authentication or authorization Handling user input or file uploads Creating new API endpoints Working with secrets or credentials Implementing payment features Storing or transmitting sensitive data Integrating third-party APIs Security Checklist 1. Secrets Management FAIL: NEVER Do This PASS: ALWAYS Do This Verification Steps [ ] No hardcoded API keys, tokens, or passwords [ ] All secrets in environment variables [ ] .env.local in .gitignore [ ] No secrets in git history [ ] Production secrets in hosting platform (Vercel, Railway) 2. Input Validation Always Validate User Input File Upload Validation Verification Steps [ ] All user inputs validated with schemas [ ] File uploads restricted (size, type, extension) [ ] No direct use of user input in queries [ ] Whitelist validation (not blacklist) [ ] Error messages don't leak sensitive info 3. SQL Injection Prevention FAIL: NEVER Concatenate SQL PASS: ALWAYS Use Parameterized Queries <!-- Do not write a literal dollar-sign-N placeholder anywhere in this file. Invoking this skill with arguments substitutes it away, and the example above then renders as concatenated SQL -- the exact anti-pattern this section warns against. Use "?" and name the Postgres form in prose. --> Verification Steps [ ] All database queries use parameterized queries [ ] No string concatenation in SQL [ ] ORM/query builder used correctly [ ] Supabase queries properly sanitized 4. Authentication & Authorization JWT Token Handling Authorization Checks Row Level Security (Supabase) Verification Steps [ ] Tokens stored in httpOnly cookies (not localStorage) [ ] Authorization checks before sensitive operations [ ] Row Level Security enabled in Supabase [ ] Role-based access control implemented [ ] Session management secure 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/security-review--0affdc