security-reviewby
Checks a change or a module for common security problems (injection, broken access control, secrets, unsafe dependencies, SSRF, XSS, insecure defaults) and explains each finding with a fix. Use when the user asks for a security review or before merging changes that handle input, authentication or fi
npx @denofy/cli add security-review --tool claude-codeInstalls to .claude/skills/security-review
Files
Reads files
Network
No network access found
Shell
No commands or scripts
From allowed-tools, bundled files and the security scan. Your agent's own permission settings still apply.
Reviews a diff or pull request for correctness, security, tests and maintainability, and reports findings ranked by severity with concrete fixes. Use when the user asks for a code review, a second opinion on a change, or "is this safe to merge?".
npx @denofy/cli add code-review --tool claude-code---name: security-reviewdescription: Checks a change or a module for common security problems (injection, broken access control, secrets, unsafe dependencies, SSRF, XSS, insecure defaults) and explains each finding with a fix. Use when the user asks for a security review or before merging changes that handle input, authentication or files.license: MITversion: 1.1.0allowed-tools: Read, Grep, Glob--- # Security review Focus on problems an attacker can actually reach. Trace untrusted input from where it enters towhere it is used. ## 1. Map the attack surface - Entry points in the change: HTTP handlers, CLI arguments, files, environment, message queues, webhooks, third-party API responses.- Sensitive sinks: database queries, shell commands, file paths, HTML output, redirects, outgoing HTTP requests, deserialisation, logging. ## 2. Checklist | Area | Look for || -------------------- | ------------------------------------------------------------------------------------ || Injection | String-built SQL, shell commands with user input, template injection || Access control | Missing ownership checks (IDOR), admin actions without role checks, trust in client || Authentication | Weak session handling, tokens in URLs, missing rate limits on login or reset || Secrets | Keys or passwords in code, config, tests or logs; secrets sent to the client || Input → output | Unescaped HTML (XSS), user-controlled redirect targets, unsafe `Content-Type` || Server-side requests | Fetching user-supplied URLs without an allowlist (SSRF), following redirects blindly || Files | Path traversal (`../`), unrestricted uploads, archives extracted without limits || Dependencies | New packages: maintained? typosquatting? install scripts? pinned versions? || Crypto | Home-made crypto, `Math.random` for tokens, missing constant-time comparison || Defaults | Debug mode, permissive CORS, missing security headers, verbose error pages | ## 3. Report For each finding give: location, how it can be exploited (a concrete request or input),impact, and the fix. Rank by severity: **critical**, **high**, **medium**, **low**.Say clearly when something is a hardening suggestion rather than an exploitable bug. ## Ground rules - Only analyse code. Do not run exploits against systems you do not own, and do not send real data anywhere.- Never print secrets you find; point to the file and line and recommend rotating them.Focus on problems an attacker can actually reach. Trace untrusted input from where it enters to where it is used.
| Area | Look for |
|---|---|
| Injection | String-built SQL, shell commands with user input, template injection |
| Access control | Missing ownership checks (IDOR), admin actions without role checks, trust in client |
| Authentication | Weak session handling, tokens in URLs, missing rate limits on login or reset |
| Secrets | Keys or passwords in code, config, tests or logs; secrets sent to the client |
| Input → output | Unescaped HTML (XSS), user-controlled redirect targets, unsafe Content-Type |
| Server-side requests | Fetching user-supplied URLs without an allowlist (SSRF), following redirects blindly |
| Files | Path traversal (../), unrestricted uploads, archives extracted without limits |
| Dependencies | New packages: maintained? typosquatting? install scripts? pinned versions? |
| Crypto | Home-made crypto, Math.random for tokens, missing constant-time comparison |
| Defaults | Debug mode, permissive CORS, missing security headers, verbose error pages |
For each finding give: location, how it can be exploited (a concrete request or input), impact, and the fix. Rank by severity: critical, high, medium, low. Say clearly when something is a hardening suggestion rather than an exploitable bug.
Drafts a clear pull request title and description from the branch's commits and diff, with context, the change, how it was tested and risks. Use when the user opens a pull request or asks for a PR description.
npx @denofy/cli add pr-description --tool claude-code