cc-skill-security-review

Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

Detailed Guide

Read [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

When to Use

• Implementing authentication or authorization
• Handling user input or file uploads
• Creating new API endpoints
• Working with secrets or credentials
• Implementing payment features
• Storing or transmitting sensitive data
• Integrating third-party APIs

Security Checklist

1. Secrets Management

❌ NEVER Do This

const leakedToken = "[redacted API key]"  // Hardcoded secret
const dbCredential = "[redacted password]" // In source code

✅ ALWAYS Do This

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

Verification Steps

• [ ] No hardcoded API keys, tokens, or passwords
• [ ] All secrets in environment variables
• [ ] .env.local in .gitignore
• [ ] No secrets in git history
• [ ] Production secrets in hosting platform (Vercel, Rai