Revisión de Seguridad
Guides the agent to check code for secrets, input validation, injection, auth and XSS/CSRF issues
- Repository
- affaan-m/ECC
- Stars
- 295,127
- Licence
- MIT
- Files
- 1 file
What it does
This is a checklist-style guide that tells an AI agent to review code it writes or changes against common security best practices. When the agent works on login, user input, file uploads, API endpoints, secrets, payments or third-party integrations, it follows the skill's patterns: keep keys in environment variables, validate input with schemas, use parameterized database queries, store tokens in httpOnly cookies, check permissions, sanitize HTML and set a Content Security Policy. The file is written in Spanish and its examples target TypeScript, Next.js, Supabase and Zod. It does not run any tools itself; it only shapes the agent's guidance.
Great for
- Developers building web apps or APIs with Node/TypeScript who want a security checklist applied while coding
- Teams new to secure coding who want concrete good-versus-bad code examples
- Spanish-speaking developers who prefer documentation in their own language
Skip it if
- Replacing a professional security audit or penetration test, since the skill is a guide and cannot verify a real system is secure
- Non-TypeScript stacks where the examples (Zod, Supabase, Next.js headers) would need heavy adaptation, as the checklist does not cover them in depth
- Reviewing code for compliance standards such as PCI-DSS for payments, which the file only mentions in passing
Try asking
- “Revisa este endpoint de login y dime si hay problemas de autenticación o almacenamiento de tokens”
- “Añade validación segura para la subida de imágenes de perfil en mi app de Next.js”
- “Comprueba si mi código tiene secretos hardcodeados o consultas SQL concatenadas”
- “Configura una Content Security Policy estricta para mi proyecto”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
security-review.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip security-review.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip security-review.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at the specific files or features you are changing so the checklist is applied to real code, not generic advice.
- Treat the checklist as a starting point and confirm findings with a dedicated security tool or a human reviewer before shipping.
- Adapt the examples to your own framework and database; the code snippets are illustrative and the file's final section (CSRF) appears truncated.
What's inside
- SKILL.md
Redistributed unmodified from affaan-m/ECC under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.