security-review

mgkyawzayya's avatarfrom mgkyawzayya

Audit code for security vulnerabilities using OWASP Top 10 guidelines. Use for security audits, pre-deploymentchecks, authentication reviews, or when checking for XSS, SQL injection, CSRF, or authorization issues. EXCLUSIVE to security-expert agent.

⭐1stars🔀0forks📁View on GitHub🕐Updated Dec 14, 2025
[Code Review]

When & Why to Use This Skill

This Claude skill provides automated security auditing for source code, leveraging OWASP Top 10 guidelines to identify and mitigate critical vulnerabilities. It streamlines the security review process by performing dependency checks, analyzing authentication patterns, and scanning for common threats like SQL injection and XSS, specifically optimized for Laravel and React environments.

Use Cases

  • Pre-deployment security audits: Automatically scan code changes for OWASP vulnerabilities before merging to production to ensure high security standards.
  • Dependency vulnerability scanning: Execute integrated tools like npm audit and composer audit to detect and report insecure third-party packages in the software supply chain.
  • Authentication and Authorization review: Verify route middleware, gate policies, and token handling logic to prevent broken access control and unauthorized data access.
  • Input validation and sanitization checks: Identify potential XSS and SQL injection risks by analyzing data flow in both frontend React components and backend Laravel controllers.
namesecurity-review
description|
allowed-toolsRead, Grep, Glob, Bash

Security Review

Exclusive to: security-expert agent

Validation Loop (MANDATORY)

Every security review MUST run these dependency checks:

composer audit            # Check PHP vulnerabilities
npm audit                 # Check JS vulnerabilities
php artisan route:list --compact  # Verify route middleware

Report any vulnerabilities found as Critical findings.

Instructions

  1. Run git diff to identify changed files
  2. Scan for security vulnerabilities using checklist below
  3. Check authentication and authorization patterns
  4. Review input validation and sanitization
  5. Report findings by severity (Critical → Warning → Suggestion)

OWASP Top 10 Checklist

# Vulnerability Laravel Check React Check
A01 Broken Access Control Policies, Gates Route guards
A02 Cryptographic Failures Hash::make, encrypt No secrets in client
A03 Injection Eloquent, query builder No dangerouslySetInnerHTML
A04 Insecure Design Business logic review Component security
A05 Security Misconfiguration .env settings Build config
A06 Vulnerable Components composer audit npm audit
A07 Auth Failures Rate limiting, sessions Token handling
A08 Data Integrity CSRF, mass assignment Form validation
A09 Logging Failures Security event logs Error boundaries
A10 SSRF URL validation API call validation

Laravel Security Checks

// Mass Assignment
$fillable = ['name', 'email'];  // ✅ Whitelist
$guarded = ['id', 'is_admin'];  // ✅ Blacklist

// SQL Injection Prevention
User::where('email', $email)->first();  // ✅ Safe
DB::raw("SELECT * FROM users WHERE email = '$email'");  // ❌ Dangerous

// CSRF
@csrf  // ✅ In forms

React Security Checks

// XSS Prevention
<div>{userInput}</div>  // ✅ Auto-escaped
<div dangerouslySetInnerHTML={{__html: userInput}} />  // ❌ XSS risk

// No secrets in client
const API_KEY = process.env.NEXT_PUBLIC_API_KEY;  // ⚠️ Visible to users

Audit Commands

composer audit          # PHP vulnerabilities
npm audit               # JS vulnerabilities
php artisan route:list  # Check route middleware

Examples

  • "Security review this PR"
  • "Check for OWASP vulnerabilities"
  • "Audit authentication flow"