Secure Code Review
When to use
Use this skill when asked to review code for security, produce findings, or prepare guidance for remediation.
Inputs to collect (if available)
- •What component(s) are in scope (API, UI, worker, infra scripts)
- •Data sensitivity (PII, auth/session, payments)
- •Deployment assumptions (internet-facing, internal, multi-tenant)
- •Any known incidents, CVEs, or audit requirements
Step-by-step process
- •Map entry points & trust boundaries
- •Enumerate request handlers, background consumers, file parsers, template renderers, and admin endpoints.
- •Identify where untrusted input crosses into privileged actions or sensitive sinks.
- •Scan for high-risk classes
- •Injection: SQL/NoSQL/LDAP/OS/template
- •Authn/authz: missing checks, insecure defaults, confused deputy
- •Deserialization & file handling: unsafe loads, path traversal, upload
- •Crypto: homegrown crypto, weak randomness, token validation mistakes
- •Logging: secrets/PII exposure, overly verbose errors
- •SSRF: URL fetchers, webhook validation gaps
- •Deep-dive the highest impact areas
- •Trace data flow from input → validation → authorization → sink.
- •Look for missing allow-lists, type confusion, and implicit conversions.
- •Write findings in a consistent format
- •Title, severity, confidence
- •Where (file/function)
- •Risk + prerequisites
- •Repro steps
- •Recommendation + verification steps
- •Close with a remediation plan
- •Quick wins (hours), medium fixes (days), structural guardrails (weeks).
Output template
Summary
- •Scope reviewed:
- •Top issues:
- •Overall risk: Low / Medium / High / Critical
Findings (repeat)
- •Title
- •Severity / Confidence
- •Where
- •Risk
- •Repro
- •Recommendation
- •Verification
Repo integration (optional)
If this repo includes prompt files under /prompts, the following are commonly relevant:
- •
secure-code-review.prompt.md - •
scan-for-insecure-apis.prompt.md - •
validate-input-handling.prompt.md - •
review-auth-flows.prompt.md