Guide · Agent skill
How to use the security-review agent skill: setup and examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
The security-review skill is a checklist-style guide for AI coding agents. It tells the agent to review the code it writes or changes against common security practices, such as keeping secrets out of source code, validating input, and checking permissions. This guide explains what the skill does, how to install it, how to trigger it with plain requests, and what to keep in mind before relying on it. You do not need prior experience with agent skills to follow it.
Revisión de Seguridadaffaan-m/ECC · MIT Download the skill Quick start
- 1Download the ZIP. Download the security-review skill ZIP file from this page.
- 2Unzip the skill folder. Unzip the file so you have a folder containing SKILL.md.
- 3Choose a location. Place the folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder for one project.
- 4Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 5Describe your task. Ask the agent for a change in a trigger area, such as login, file uploads, API endpoints, secrets or payments.
- 6Review the output. Check the agent's code against the checklist items and confirm secrets, validation and permissions are handled.
What the security-review skill makes the agent do
The skill applies when the agent works on authentication or authorization, user input or file uploads, new API endpoints, secrets or credentials, payment features, storing or transmitting sensitive data, or third-party API integrations. In those cases the agent follows the skill's patterns and checklists while it writes code.
The skill's guidance is built around concrete good-versus-bad examples. It covers secret management, input validation with schemas, parameterized SQL, token storage in httpOnly cookies, authorization checks, XSS prevention with HTML sanitizing and a Content Security Policy, CSRF protection, and rate limiting.
- Keep keys and passwords in environment variables, not in source code
- Validate user input with schemas and allow-lists, and restrict file uploads by size, type and extension
- Use parameterized queries instead of concatenating SQL strings
- Store tokens in httpOnly cookies rather than localStorage
- Check permissions before sensitive operations and enable Row Level Security in Supabase
- Sanitize user-provided HTML and start with a strict Content Security Policy
- Use CSRF tokens on state-changing operations and SameSite=Strict cookies, and apply rate limits to APIs
Install the skill from a ZIP file
Download the ZIP file for the skill from this page and unzip it. The skill is a folder that contains a file named SKILL.md. Put that folder in one of these locations: the personal skills folder ~/.claude/skills/, or the .claude/skills/ folder inside a specific project if you want the skill to apply only to that project.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
- Personal use across projects: place the folder in ~/.claude/skills/
- One project only: place the folder in the project's .claude/skills/ folder
- Claude apps: upload the skill under Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need a special command. The skill is meant to be used when the agent is doing relevant work, so describe the task in plain language. Mentioning security or review explicitly makes it more likely the checklist is applied to the whole change.
Examples of requests that match the skill's trigger topics:
- Add a login flow with email and password and make sure it is secure
- Create an API endpoint that updates a user's profile and review it for security issues
- Add a file upload for profile photos and check the validation
- Connect our app to a third-party payment API and review the secrets handling
- Review the code you just wrote for SQL injection and XSS risks
Review a real example: input validation
The skill's validation pattern uses the Zod library to define a schema and parse input before it reaches the database. Invalid input is returned as errors instead of being processed. The file upload example checks size (maximum 5MB), MIME type, and file extension against allow-lists.
Ask the agent to apply the same pattern to your own forms and endpoints, and to explain which checks it added.
const CreateUserSchema = z.object({
email: z.string().email(),
name: z.string().min(1).max(100),
age: z.number().int().min(0).max(150)
})What the skill needs and how it behaves
The skill lists no requirements. It does not run any scripts and does not use the network. It does not run any tools itself; it only shapes the agent's guidance. The code examples target TypeScript, Next.js, Supabase and Zod, so the guidance fits those stacks most directly.
Because the skill is a guide, the agent's changes still need your own review and testing. The skill cannot confirm that a real system is secure.
- Requirements: none listed
- Runs scripts: no
- Uses network: no
- Files included: SKILL.md
Tips for getting the most from it
Ask the agent to go through the checklist items for the area you changed, not just to say the code is secure. Check whether the agent's output matches each item, such as whether secrets are read from process.env and whether Supabase tables have RLS enabled.
The checklists are written in Spanish, and the agent can follow them whatever language you use to talk to it. Teams new to secure coding can use the good-versus-bad examples as a reference while they work.
- Name the feature you are changing (login, upload, payment) so the right checklist is applied
- Ask for a list of which checklist items were addressed and which were not
- Verify secrets are not committed by checking your .gitignore and git history yourself
- Treat the Content Security Policy example as a starting point and adapt the allowed domains to your app
What people use it for
- Adding a login flow and checking token storage and authorization checks
- Building an upload feature with size, type and extension restrictions
- Creating API endpoints that validate input with Zod schemas
- Writing Supabase queries and Row Level Security policies with a checklist
- Teaching a junior developer good-versus-bad secure coding patterns
Frequently asked questions
How do I install the security-review skill?
Download the ZIP file from this page and unzip it so you have a folder containing SKILL.md. Place that folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.
Does the security-review skill require anything else to run?
The skill lists no requirements. It runs no scripts and uses no network access, and it only shapes the agent's guidance rather than running tools.
Is the security-review skill free?
The source material is released under the MIT licence. Check the licence file in the source repository for the exact terms before you redistribute it.
Can this skill replace a security audit?
No. The skill is a checklist and set of patterns that guide the agent while it codes. It cannot verify that a real system is secure, so a professional security audit or penetration test is still needed for production systems.
Does it work with languages other than TypeScript?
The examples target TypeScript, Next.js, Supabase and Zod. Other stacks would need significant adaptation, since the checklist does not cover them in depth.
Does the skill cover PCI-DSS or other compliance standards?
No. PCI-DSS is only mentioned in passing, so the skill is not a compliance review for payments or other regulated data.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you build web apps or APIs with Node and TypeScript and want a security checklist applied while the agent codes, especially if you are new to secure coding. Pick something else if you need a professional audit, a compliance review such as PCI-DSS, or guidance for a stack other than TypeScript, Next.js, Supabase and Zod.
Download the skill