secure-code-review

What this skill does

Performs a structured security-focused code review across 10 domains: Input Validation, Authentication & Session Management, Authorization & Access Control, Injection Prevention, Cryptography, Error Handling & Logging, Data Protection, Dependency Security, Configuration Security, and Race Conditions. Maps findings to CWE identifiers and severity levels, and produces a report with remediation guidance and proof-of-concept notes.

When to use

• During pull request review for security-sensitive code changes (auth, payments, file handling, crypto)
• Before a production release to verify security controls are in place
• When onboarding a legacy codebase with no prior security review history
• When a bug bounty report or vulnerability disclosure references a code-level flaw requiring root cause analysis

Prerequisites

• No external tools required (checklist-based; use with source code access)
• Read access to the source code under review
• (Optional) Static analysis output from tools such as Semgrep, CodeQL, or Bandit to supplement manual review
• CWE reference: https://cwe.mitre.org

Inputs