Security Code Review

This skill is explicit-invoke only (disable-model-invocation: true) and read-only (allowed-tools covers reading + searching, no editing). It surfaces findings — fixing them is a separate, deliberate step.

Categories to check

• Injection: SQL, NoSQL, OS command, LDAP, XPath, template
• XSS: reflected, stored, DOM-based; encoding context (HTML body vs. attribute vs. JS context)
• AuthN / AuthZ: missing checks, broken object-level authorization, privilege escalation
• Input validation: trust boundaries, type confusion, deserialization
• Sensitive data exposure: secrets in code, tokens in logs, PII in error responses, weak hashing
• Cryptography: hardcoded keys, ECB mode, weak algorithms (MD5/SHA-1 for security), missing IV randomness

Output

For each finding, report: