security-review_skill

Overview

This skill performs code security audits focused on OWASP Top 10 risks. It is designed for the security-expert agent to run pre-deployment checks, pull request reviews, and focused authentication or authorization reviews. The goal is to produce actionable findings categorized by severity.

How this skill works

The skill inspects changed files (git diff) and runs mandatory dependency audits (composer audit, npm audit) plus framework checks like php artisan route:list. It scans for OWASP Top 10 patterns across Laravel and React code, reviews authentication/authorization, input validation, sanitization, and component/browser secrets. Findings are reported as Critical → Warning → Suggestion with remediation notes.

When to use it

• Before merging a pull request that touches authentication, authorization, or input handling
• Prior to deploying a release to production
• When auditing third-party dependency changes or new packages
• When reviewing routes, middleware, or API surface for access control
• When investigating reported XSS, SQL injection, CSRF, or SSRF concerns

Best practices

• Always run the mandatory validation loop: git diff, composer audit, npm audit, php artisan route:list
• Focus on changed files first, then expand to related modules and configuration (.env, build settings)
• Map findings to OWASP Top 10 and include specific code references and reproduction steps
• Prioritize fixes: treat dependency and runtime-executable vulnerabilities as Critical
• Recommend framework-native mitigations (e.g., Laravel fillable/guarded, @csrf, Hash::make) and avoid exposing secrets in client builds

Example use cases

• Security review of a pull request that adds new API endpoints or middleware
• Pre-deployment audit to confirm no regression in authentication, rate limiting, or CSRF protections
• Audit a React component library for XSS risks and accidental client-side secret leaks
• Check a Laravel application for mass assignment, SQL injection patterns, and route middleware gaps
• Investigate dependency CVEs reported by web search or security scanner