security-review

---
name: security-review
description: Read-only security audit of code for SQL injection, XSS, auth/authz flaws, input validation gaps, sensitive data exposure, and insecure cryptography. Surfaces findings without modifying code.
allowed-tools:
  - Read
  - Grep
  - Glob
disable-model-invocation: true
user-invocable: true
---

# Security Code Review

This skill is **explicit-invoke only** (`disable-model-invocation: true`) and **read-only** (`allowed-tools` covers reading + searching, no editing). It surfaces findings — fixing them is a separate, deliberate step.

## Categories to check

- **Injection**: SQL, NoSQL, OS command, LDAP, XPath, template
- **XSS**: reflected, stored, DOM-based; encoding context (HTML body vs. attribute vs. JS context)
- **AuthN / AuthZ**: missing checks, broken object-level authorization, privilege escalation
- **Input validation**: trust boundaries, type confusion, deserialization
- **Sensitive data exposure**: secrets in code, tokens in logs, PII in error responses, weak hashing
- **Cryptography**: hardcoded keys, ECB mode, weak algorithms (MD5/SHA-1 for security), missing IV randomness

## Output

For each finding, report:

1. **File and line** (Path:Line format so the user can jump to it)
2. **Severity** (critical / high / medium / low / informational)
3. **What's wrong**
4. **What an attack would look like**
5. **A recommended fix direction** (not the actual code change — that's a separate skill)

Group findings by severity. Don't speculate about issues you can't see in the code; if a check requires runtime context you don't have, say so.