security-review
Perform security-focused code review using OWASP guidelines and AI-specific security best practices.
When & Why to Use This Skill
This Claude skill automates security-focused code reviews by integrating OWASP guidelines and specialized AI security best practices. It identifies critical vulnerabilities such as injection flaws, broken authentication, and sensitive data exposure, while specifically addressing modern risks like AI-generated code hallucinations and dependency 'slopsquatting'. By providing structured reporting and actionable remediation steps, it ensures codebases remain secure and compliant throughout the development lifecycle.
Use Cases
- Reviewing AI-generated code to detect hallucinated packages, insecure defaults, and logic flaws before integration.
- Conducting automated OWASP Top 10 audits on pull requests to prevent SQL injection, XSS, and broken access control.
- Scanning codebases for hardcoded secrets, API keys, and unencrypted sensitive data (PII) to prevent data leaks.
- Performing dependency security checks and 'slopsquatting' prevention to verify the legitimacy of third-party libraries.
- Generating comprehensive security finding reports with severity levels and fix recommendations for security-sensitive projects.
| name | security-review |
|---|---|
| description | Perform security-focused code review using OWASP guidelines and AI-specific security best practices. |
| allowed-tools | Read, Grep, Glob |
Security Review Skill
This skill performs comprehensive security analysis of code, with special attention to AI-generated code vulnerabilities.
When to Use
Activate this skill when:
- Reviewing AI-generated code
- Auditing authentication/authorization code
- Checking for OWASP Top 10 vulnerabilities
- Validating dependency security
- Before merging security-sensitive PRs
OWASP Top 10 Checks
1. Injection Prevention
- SQL Injection: Use parameterized queries, never concatenate user input
- Command Injection: Avoid shell execution with user input, use safe APIs
- XSS: Sanitize all HTML output, use content security policies
2. Broken Authentication
- No hardcoded credentials or API keys
- Secure password hashing (bcrypt, argon2)
- Proper session management with secure cookies
- Multi-factor authentication for sensitive operations
3. Sensitive Data Exposure
- Encrypt data at rest and in transit
- Never log passwords, tokens, or PII
- Use environment variables for secrets
- Implement proper key management
4. XML External Entities (XXE)
- Disable external entity processing
- Use less complex data formats (JSON)
- Validate and sanitize XML input
5. Broken Access Control
- Implement principle of least privilege
- Validate authorization on every request
- Use secure direct object references
- Deny by default
AI-Specific Security
Slopsquatting Prevention
Before adding any dependency:
- Verify existence on the package registry (npm, PyPI, etc.)
- Check download counts - legitimate packages have thousands of downloads
- Check maintenance status - last update, open issues
- Review for vulnerabilities -
npm audit,pip-audit - Cross-reference with official documentation
AI Code Review Checklist
- No hardcoded secrets or API keys
- Input validation present on all user inputs
- Error messages don't expose internal details
- Dependencies are verified (not hallucinated)
- Authentication/authorization properly checked
- No eval() or dynamic code execution with user input
- SQL queries use parameterized statements
- File operations validate paths
- Rate limiting on public endpoints
- Logging doesn't include sensitive data
Common AI Code Vulnerabilities
| Vulnerability | AI Pattern | Mitigation |
|---|---|---|
| Hallucinated packages | Non-existent npm/pip packages | Verify on registry |
| Insecure defaults | verify=False, secure=False |
Enable security by default |
| Missing input validation | Direct user input usage | Add validation layer |
| Verbose error messages | Stack traces to users | Generic error responses |
| Hardcoded credentials | API keys in code | Use environment variables |
Security Commands
npm audit # Check for known vulnerabilities
npm audit fix # Auto-fix vulnerabilities
npx snyk test # Deep vulnerability scan
npm outdated # Check for outdated packages
Reporting Format
When reporting security issues:
## Security Finding
**Severity**: Critical/High/Medium/Low
**Category**: [OWASP category]
**Location**: [file:line]
**Description**: [What the vulnerability is]
**Impact**: [What could happen if exploited]
**Recommendation**: [How to fix it]
**References**: [OWASP/CWE links]