Skip to content
Get packs

Security Review Checklist

Gives the agent a security checklist and secure-coding patterns to review code against.

Source Download skill
Repository
affaan-m/ECC
Stars
295,127
Licence
MIT
Files
2 files

What it does

When you ask an AI agent to add login, handle user input, work with secrets, build API endpoints, or touch payments, this skill makes it check the code against a security checklist. It covers hardcoded secrets, input validation, SQL injection, authentication and authorization, XSS, CSRF, and rate limiting, and shows example code for each, marking what to avoid and what to do instead. It is a guide the agent follows; it does not scan or change your project on its own.

Great for

  • Developers building web apps or APIs who want a second pair of eyes on auth, input handling, or secrets
  • Teams wanting a consistent pre-release security checklist applied by an AI agent
  • Developers using TypeScript, Next.js, Supabase, or Express who want examples matching those stacks

Skip it if

  • Replacing a professional security audit or penetration test, since the checklist is generic and the agent can miss issues
  • Non-developers with no way to verify the advice, because the examples assume specific libraries (zod, Supabase, Express, DOMPurify) and may not fit your code
  • Projects where the example patterns conflict with your framework; applying them blindly could introduce bugs or weaken protections

Try asking

  • “Review this login endpoint for security problems before I deploy it”
  • “Check how I handle file uploads in this project against the security checklist”
  • “Audit my Supabase tables and queries for missing row level security or injection risks”
  • “Add input validation and rate limiting to my new payment API route”
Step-by-step guide: how to use Security Review ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    security-review.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip security-review.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip security-review.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the agent at specific files or folders so it applies the checklist to real code rather than general advice
  • Ask it to report each checklist item as pass, fail, or not applicable, with the file and line for each failure
  • Treat its findings as a starting point and confirm critical issues with a dedicated security tool or expert review

What's inside

  • agents/openai.yaml
  • SKILL.md

Redistributed unmodified from affaan-m/ECC under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.