ReviewOfficialCertified

security-review

by Skills Hub

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation.

v2.0.1183 installs

Signing

SignedSLSA L2
Signed by
skills-hub.ai distributor
Method
Distributor-signed by skills-hub.aiCryptographically signed by the skills-hub.ai distributor key at publish time.
Signed

Install this skill

Run this command in your terminal. No account required — it auto-detects your AI tool and installs the skill file.

npx @skills-hub-ai/cli install security-review
Or download directly:
Browse all CLI commands →

Setup by platform

Claude Code

~/.claude/skills/<skill>/SKILL.md

Setup guide →

Install

One-click setup for your editor

Run in your project root

npx @skills-hub-ai/cli install security-review --target claude-code
2

Instructions

This skill doesn’t include stateful context yet, instructions only. Learn about stateful skills.

Security

Loading security scan...

Reviews (0)

View full changelog & diffs →

Related skills

Browse all →
design-auditComprehensive autonomous design quality audit across accessibility (WCAG 2.2), performance, theming, responsive/adaptive design, and anti-pattern detection. Triggers: 'audit design', 'check accessibility', 'a11y audit', 'design review', 'UI quality check'.58 installsdesign-polishFinal autonomous quality pass before shipping. Fixes alignment, spacing, consistency, typography hierarchy, color harmony, motion timing, and every micro-detail that separates good from great..52 installsdiagramGenerate Mermaid architecture diagrams from your codebase. Produces C4 context and container diagrams, sequence diagrams for key flows, ER diagrams from database schemas, and module dependency graphs. Use when you need architecture diagrams, system diagrams, database ERD, sequence diagrams, dependency visualization, or C4 model diagrams.52 installsresponsiveAudit and fix responsive design issues across all breakpoints. Scans for fixed widths that cause mobile overflow, missing media query variants, non-responsive images, undersized touch targets below 48px, unreadable typography, and horizontal scroll violations..49 installssecureFull-stack security posture assessment with 0-100 risk scoring. Scans dependency vulnerabilities (npm audit, pip-audit, cargo audit, govulncheck), dangerous code patterns (SQL injection, eval, command injection, ReDoS, innerHTML, XSS vectors), authentication gaps (missing auth middleware.47 installscode-smellScan codebase for Martin Fowler's catalog of code smells: god classes, long methods, feature envy, data clumps, primitive obsession, shotgun surgery, message chains, and more. Triggers: code feels messy, before a major refactor, to find maintainability problems.44 installs

More from Skills Hub

View source →
unit-testGenerate comprehensive unit tests with edge cases, error paths, and boundary values. Triggers: you need to add unit tests, increase code coverage, test edge cases, or verify error handling paths.156 installsdesign-to-codeTurn a design into production-quality frontend code: extract a design system with tokens and components, make layouts responsive across breakpoints, add dark mode with WCAG-compliant theming, then run a UX audit to validate everything..123 installsflutterBuilds Flutter applications from videos, screenshots, descriptions, or app clone requests. Triggers on: flutter app, build a mobile app, replicate this app in Flutter, build from video, build from screenshots, clone this app, build an app, make an app like, recreate this UI.118 installshumanizerMulti-pass editor that removes AI-writing tells from drafted content — eliminates filler phrases, balances sentence length, restores opinion and voice, and strips em-dash overuse so posts sound human and opinionated rather than ChatGPT-generic..112 installsweb-gameScaffolds a browser-based game with Phaser 3, PixiJS, or Three.js including game loop, asset pipeline, responsive canvas, input handling, audio, save/load, and deployment to itch.io or web. Triggers: on: "web game", "browser game", "html5 game", "phaser game", "pixi game".110 installsdesign-animateAdd purposeful motion to interfaces using modern CSS — scroll-driven animations, view transitions, @starting-style, and GPU-accelerated transforms. Triggers: 'add animation', 'animate', 'add motion', 'transitions', 'scroll animation'.72 installs

More Review skills

Browse category →
code-reviewThorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity.1,119 installsrefactorSystematic code refactoring — extract functions, reduce complexity, eliminate duplication, improve naming, and split large files. Preserves behavior with tests.189 installssecurity-auditScan a codebase for security vulnerabilities — OWASP Top 10, secrets in code, dependency CVEs, auth flaws, injection risks, and misconfigurations. Fixes what it finds.64 installsarch-reviewArchitect-level story review with component reuse, domain consistency, data privacy, service architecture, and infrastructure checks. Design review before coding or implementation validation after.23 installsapi-reviewReview API design against REST best practices and internal consistency. Triggers: you need to review an API, audit REST endpoints, check API consistency, fix HTTP status codes, add pagination.22 installsdatabase-reviewReview database schema design, query patterns, and data access layer for correctness and performance. Triggers: you need to review a database schema, find missing indexes, detect N+1 queries, audit data types.19 installs

Frequently asked questions about security-review

What does the security-review skill do?

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation. It's a reusable SKILL.md instruction set that loads into your AI coding assistant on demand, no prompt engineering, no copy-pasting every session.

How do I install the security-review skill?

Run `npx @skills-hub-ai/cli install security-review` from your terminal. The CLI writes the SKILL.md to the correct location for your AI tool (e.g. ~/.claude/skills/security-review/ for Claude Code or ~/.cursor/skills/ for Cursor with --target cursor) and adds it to your project's .skills.json lockfile.

Which AI tools does security-review work with?

security-review runs in Claude Code. It follows the open Agent Skills standard (SKILL.md), so the same skill works in every supported tool without modification.

Is the security-review skill free?

Yes. Every skill on skills-hub.ai is free and open-source. There are no premium tiers, paywalls, or usage limits. You only pay for whatever AI assistant you're already using.

How do I use security-review after installing it?

In Claude Code, type `/security-review` (or whatever slash command the skill registers) and the AI follows the skill's instructions immediately. You can also reference it by name in natural language, your AI loads the skill into context when relevant.

Can I share the security-review skill with my team?

Yes. Commit your project's .skills.json lockfile and teammates run `npx @skills-hub-ai/cli install` (no args) to install every skill at the exact version you pinned. Organization-scoped installs work via skills-hub.ai organizations.