Guide · Agent skill
How to use the security-review agent skill: setup and examples
Updated · written with AI from the project's own documentation and checked against our catalogue data
The security-review skill is a set of instructions that an AI coding agent loads and follows when you ask it to add login, handle user input, work with secrets, create API endpoints, or build payment features. It makes the agent check the code it writes against a security checklist, with example code for each item. After reading this guide you will know what the skill does, how to install it, how to trigger it with plain requests, and where it falls short.
Security Review Checklistaffaan-m/ECC · MIT Download the skill Quick start
- 1Download the ZIP. Download the security-review ZIP file from this page. The skill is MIT licensed.
- 2Unzip into a skills folder. For a personal setup, unzip into ~/.claude/skills/. For one project only, unzip into that project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill.
- 4Describe your task. Ask the agent for work involving authentication, user input, secrets, API endpoints, or payments, and name your stack.
- 5Check the output. Review the agent's changes against the checklist and test them, since the agent can miss issues.
What does the security-review skill make the agent do?
The skill is a checklist and a set of patterns. When it is active, the agent reviews its work against eight areas: secrets management, input validation, SQL injection prevention, authentication and authorization, XSS prevention, CSRF protection, rate limiting, and sensitive data exposure.
For each area the skill shows what to avoid (marked FAIL) and what to do instead (marked PASS), and it ends each area with a verification checklist. The skill is a guide the agent follows. It does not scan or change your project on its own.
- Hardcoded secrets: keep keys and passwords in environment variables and check that they exist
- Input validation: validate user input with schemas and restrict file uploads by size, type and extension
- SQL injection: use parameterized queries instead of concatenated SQL
- Authentication and authorization: store tokens in httpOnly cookies, check permissions before sensitive operations, and enable Row Level Security in Supabase
- XSS and CSRF: sanitize user HTML, configure a Content Security Policy, and use CSRF tokens and SameSite cookies
- Rate limiting and data exposure: limit API requests and avoid logging passwords or card data
How do you install the security-review skill?
Download the ZIP file from this page. You can install the skill in one of two ways.
For a personal setup, unzip the download into ~/.claude/skills/. To make it available only in one project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps, you can instead upload the skill under Settings, then Capabilities, then Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
How do you trigger the skill with natural requests?
You do not need a special command. The skill's description tells the agent when to use it: adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment or sensitive features. Describe your task in those terms and the agent can pick up the skill.
Naming the kind of work helps. Mention the feature and the stack you are using so the agent applies the examples that match your code.
- Add a login form with email and password for my Next.js app and make sure it follows our security checklist.
- Create an Express endpoint that accepts a file upload for profile photos and check the input handling.
- Review how this checkout flow handles card data and secrets before we release it.
- Build a search API route and apply sensible rate limits.
What do the examples assume, and what do they need?
The skill itself installs nothing and needs an AI agent runtime that loads SKILL.md skills, such as Claude Code. The example code assumes TypeScript and uses zod for validation, Express for rate limiting, Next.js for routes and headers, Supabase for queries and Row Level Security, and DOMPurify for HTML sanitizing.
If your project uses a different library or framework, the agent has to adapt the patterns. Check that the adapted code still does what the checklist asks before you rely on it.
- Runtime: an AI agent that loads SKILL.md skills (for example Claude Code)
- Example stack: TypeScript, zod, Express, Next.js, Supabase, DOMPurify
- Runs scripts: no
- Uses network: no
const { data } = await supabase
.from('users')
.select('*')
.eq('email', userEmail)What are the safety limits of this skill?
The skill does not run scripts or make network requests, according to its own listing. It is text the agent reads and follows, so its safety value depends on the agent actually applying it to your code.
The checklist is generic and the agent can miss issues. The skill is not a replacement for a professional security audit or penetration test. Do not apply the example patterns blindly, because they can conflict with your framework and introduce bugs or weaken protections. Read each change the agent proposes.
- Not a substitute for a professional security audit or penetration test
- The agent can miss issues, so review its output yourself
- Example patterns may not fit your framework; test them before use
What tips help you get the most from it?
Ask for the review at the moment you write the risky code, such as when you add authentication or a payment flow, rather than at the end. Use the verification checklists at the end of each section as a manual pre-release list.
Teams can use the skill to apply one consistent checklist across projects. Pair it with your own tests and with a human reviewer for anything that handles money or personal data.
- Ask for the review while you write authentication, input, or payment code
- Use the verification checklists as a pre-release review list
- Give the agent your stack so it picks matching examples
- Keep secrets out of code and out of logs
What people use it for
- Reviewing a login or signup flow for secrets handling, validation and token storage
- Checking an Express or Next.js API endpoint for rate limiting and authorization checks
- Adding file upload validation that limits size, type and extension
- Applying a consistent pre-release security checklist across a team's web app or API
Frequently asked questions
How do I install the security-review skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for a personal setup, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can upload it under Settings, then Capabilities, then Skills.
Is the security-review skill free?
The skill is listed under the MIT license. The skill itself installs nothing, but you need an AI agent runtime that loads SKILL.md skills, such as Claude Code.
What do I need to run the security-review skill?
You need an AI agent runtime that loads SKILL.md skills, for example Claude Code. The examples assume TypeScript, zod, Express, Next.js, Supabase and DOMPurify, but you do not need to install those for the skill itself.
Does the security-review skill scan my code?
No. It is a guide the agent follows and does not scan or change your project on its own. Its checks happen only when the agent applies the checklist to the code it is working on.
Can the security-review skill replace a security audit?
No. The checklist is generic and the agent can miss issues, so it is not a replacement for a professional security audit or penetration test. Use it as a second pair of eyes alongside expert review.
How does this skill compare with other security tools?
The skill is a set of checklist instructions for an AI agent, not a scanner or a test suite. It does not run scripts or make network requests, so it differs from tools that analyse code automatically. Choose it when you want an agent to follow a consistent checklist while it writes code.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you build web apps or APIs in TypeScript-style stacks and want an AI agent to check auth, input handling, and secrets against a consistent checklist. Pick something else, such as a professional audit or a dedicated scanner, if you need assurance for production payment or personal data, or if you cannot verify the advice yourself.
Download the skill