security-review

htooayelwinict's avatarfrom htooayelwinict

Audit code for security vulnerabilities using OWASP Top 10 guidelines. Use for security audits, pre-deploymentchecks, authentication reviews, or when checking for XSS, SQL injection, CSRF, or authorization issues. EXCLUSIVE to security-expert agent.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 22, 2025
[Code Review]

When & Why to Use This Skill

This Claude skill automates comprehensive security audits by scanning source code for vulnerabilities based on the OWASP Top 10 guidelines. It specializes in identifying critical risks like SQL injection, XSS, and CSRF, providing actionable mitigation strategies for modern frameworks like Laravel and React to ensure robust application security during pre-deployment checks.

Use Cases

  • Pre-deployment Security Audit: Automatically scan new code changes for OWASP Top 10 vulnerabilities before merging to production to prevent security regressions.
  • Authentication & Authorization Review: Verify that route guards, policies, and session handling are correctly implemented to prevent broken access control and unauthorized data access.
  • Dependency Vulnerability Scanning: Execute automated checks using tools like 'npm audit' and 'composer audit' to identify and report insecure third-party packages within the codebase.
  • Framework-Specific Hardening: Review Laravel Eloquent queries and React component rendering patterns to ensure best practices for input sanitization and XSS prevention are followed.
namesecurity-review
description|
allowed-toolsRead, Grep, Glob, Bash, mcp_context7

Security Review

Exclusive to: security-expert agent

📚 Context7 (Memory) — Up-to-Date Docs

Lookup security patterns and vulnerability mitigations:

mcp_context7_resolve-library-id(libraryName="laravel", query="csrf protection")
mcp_context7_query-docs(libraryId="/laravel/docs", query="authentication security")

Validation Loop (MANDATORY)

Every security review MUST run these dependency checks:

composer audit            # Check PHP vulnerabilities
npm audit                 # Check JS vulnerabilities
php artisan route:list --compact  # Verify route middleware

Report any vulnerabilities found as Critical findings.

Instructions

  1. Run git diff to identify changed files
  2. Scan for security vulnerabilities using checklist below
  3. Check authentication and authorization patterns
  4. Review input validation and sanitization
  5. Report findings by severity (Critical → Warning → Suggestion)

OWASP Top 10 Checklist

# Vulnerability Laravel Check React Check
A01 Broken Access Control Policies, Gates Route guards
A02 Cryptographic Failures Hash::make, encrypt No secrets in client
A03 Injection Eloquent, query builder No dangerouslySetInnerHTML
A04 Insecure Design Business logic review Component security
A05 Security Misconfiguration .env settings Build config
A06 Vulnerable Components composer audit npm audit
A07 Auth Failures Rate limiting, sessions Token handling
A08 Data Integrity CSRF, mass assignment Form validation
A09 Logging Failures Security event logs Error boundaries
A10 SSRF URL validation API call validation

Laravel Security Checks

// Mass Assignment
$fillable = ['name', 'email'];  // ✅ Whitelist
$guarded = ['id', 'is_admin'];  // ✅ Blacklist

// SQL Injection Prevention
User::where('email', $email)->first();  // ✅ Safe
DB::raw("SELECT * FROM users WHERE email = '$email'");  // ❌ Dangerous

// CSRF
@csrf  // ✅ In forms

React Security Checks

// XSS Prevention
<div>{userInput}</div>  // ✅ Auto-escaped
<div dangerouslySetInnerHTML={{__html: userInput}} />  // ❌ XSS risk

// No secrets in client
const API_KEY = process.env.NEXT_PUBLIC_API_KEY;  // ⚠️ Visible to users

Audit Commands

composer audit          # PHP vulnerabilities
npm audit               # JS vulnerabilities
php artisan route:list  # Check route middleware

Examples

  • "Security review this PR"
  • "Check for OWASP vulnerabilities"
  • "Audit authentication flow"