mcpField
S
security-review

security-review

github.com/dralgorhythmSecurity12998 installsUpdated 14w ago
Repository

About security-review

security-review is a checklist-based skill for reviewing application security. It covers common security areas and code patterns to flag, and provides a structured report format.

Key features

  1. 01Check authentication and authorization
  2. 02Review input validation and output encoding
  3. 03Assess cryptography and error handling
  4. 04Inspect logging practices
  5. 05Flag SQL injection, XSS, and hardcoded secrets
  6. 06Structure findings in a review report

Use cases

  1. 01Review authentication and access controls
  2. 02Check code for common vulnerability patterns
  3. 03Assess handling of errors and sensitive logs
  4. 04Document findings by severity

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/dralgorhythm/claude-agentic-framework --skill security-review

After installing, type/security-reviewin Claude Code to confirm it loaded.

Details

From the project README

Security Review

Review Checklist

Authentication
  • Strong password requirements enforced
  • MFA implemented for sensitive operations
  • Session tokens are cryptographically secure
  • Session timeout is appropriate
  • Logout properly invalidates session
Authorization
  • Access controls checked server-side
  • Least privilege principle applied
  • Role-based access properly implemented
  • Direct object references validated
Input Validation
  • All input validated server-side
  • Input type and length checked
  • Special characters properly handled
  • File uploads validated and restricted
Output Encoding
  • HTML output properly encoded
  • JSON responses use proper content type
  • Error messages don't leak information
Cryptography
  • Strong algorithms used (AES-256, RSA-2048+)
  • No custom crypto implementations
  • Keys properly managed
  • TLS 1.2+ enforced
Error Handling
  • Exceptions handled gracefully
  • Error messages don't expose internals
  • Failed operations logged
Logging
  • Security events logged
  • Sensitive data not logged
  • Logs protected from tampering

Code Patterns to Flag

SQL Injection
// DANGER
db.query(`SELECT * FROM users WHERE id = ${id}`);
XSS
// DANGER
element.innerHTML = userInput;
Hardcoded Secrets
// DANGER
const API_KEY = "sk-abc123...";
Insecure Random
// DANGER
Math.random(); // For security purposes

Security Review Report

## Security Review: [Component]

### Summary
- Critical: [X]
- High: [X]
- Medium: [X]
- Low: [X]

### Findings

#### [CRITICAL] SQL Injection in UserService
**Location**: src/services/user.ts:47
**Description**: User input concatenated into SQL query
**Remediation**: Use parameterized queries
**Code**:
```typescript
// Current (vulnerable)
// Recommended fix

Comments

Markdown supported