security-review — Security Audit

• Trigger: /security-review or keywords "security review", "security audit", "vulnerability check"
• Best for: Code security review, dependency vulnerability checks, auth flow audit
• Not for: General code review (use review), penetration testing

Overview

security-review performs focused security audits covering OWASP Top 10: injection attacks, authentication flaws, sensitive data exposure, XXE, broken access control, and more.

Trigger Conditions

security-review auto-triggers when you:

• Mention "security check", "security audit"
• Work on auth/authz/encryption code
• Use the /security-review command

Examples

Example 1: API Security Audit

/security-review Audit all endpoints under src/api/ for security

Claude checks for:

• SQL injection (parameterized queries)
• XSS protection (input/output encoding)
• CSRF protection
• Auth middleware coverage
• Sensitive data in logs

Example 2: Auth Flow Audit

/security-review Audit the login and token refresh flow for security

Example 3: Dependency Check

/security-review Check package.json for dependencies with known vulnerabilities

Example 4: File Upload

/security-review Audit file upload: type validation, size limits, storage security

Example 5: Access Control

/security-review Audit role-based permission checks for privilege escalation risks

Audit Checklist

Category	What's Checked
Injection	SQL, NoSQL, OS command, LDAP injection
Authentication	Password policy, session management, JWT security
Authorization	Privilege escalation, missing auth checks
Data	Encryption at rest, log sanitization, transport security
Input	XSS, file upload, deserialization
Configuration	Security headers, CORS, error message leakage

Notes

• This is a deep security audit, more focused than review
• Findings are tagged by severity: Critical / High / Medium / Low
• Production code should be audited regularly
• Not a replacement for professional penetration testing
• Sensitive config issues (keys, tokens) should be addressed immediately

Related Skills

• review — General code review
• diagnose — Security incident investigation
• update-config — Configure security-related permissions and env vars