Review an application's code for security across frontend AND backend and produce a prioritized, safe-to-apply remediation plan — OWASP Top 10 (2025), OWASP API Top 10, plus privacy (LGPD/GDPR). Use when the user asks for a "security review", "security audit", "harden this", "is this secure?", "check for vulnerabilities", "OWASP", "pentest-style review", or wants a focused security pass on a feature/PR/app (secrets, access control, injection, auth/session, headers/CORS/CSRF, file upload…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security review
Audit the application's code for real vulnerabilities — frontend and backend — and hand back a prioritized, **safe-to-apply** plan. The goal is to shrink the attack surface **without changing what a legitimate user sees or breaking the app**.
## Read first (always)
List `learnings/` and read anything relevant. **Reuse, don't re-derive:**
- The **always-on blocker set** applied to every PR lives in `../reviewing-code/references/security-checks.md` (PII in logs, injection, HMAC/signature, the AI-generated-code lens). Apply it — don't re-list it.
- The **build-time prevention rules** live in `../developing-features/references/security.md` (auth/session, DB least-privilege, TLS, supply chain, and the full AI/LLM guardrails) and `../developing-features/references/untrusted-content.md` (prompt injection).
- This skill adds the **OWASP-2025 breadth**, the **frontend / infra / privacy gaps**, and the **safe-remediation protocol** (see `references/`).
## How to run a security review
…
The line at the top of this page pins the label git:20261103.b450fa3, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_katt6wcj4utgs3dz
GET https://markdownregistry.com/api/v1/resolve?ref=cristhianzl/claude-skills-czl/security-review
GET https://markdownregistry.com/api/v1/blob/87bae8a605c8bcab1273bb61cd94e263397d87b2bd34dcb51fc612b185f59dc6
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
cristhianzl/claude-skills-czl · configs/agnostic/skills/api-design/SKILL.md · Design and review HTTP/REST (and choose between REST/GraphQL/gRPC) APIs that are contract-first, resource-oriented…
cristhianzl/claude-skills-czl · configs/agnostic/skills/building-frontend-ui/SKILL.md · Build, refactor, and review frontend UI in any framework — components, accessibility, forms, client state and data…
cristhianzl/claude-skills-czl · configs/agnostic/skills/debugging-agent-runs/SKILL.md · Recover when the AGENT itself is stuck — looping, repeating the same failed action, burning tokens/budget, overflowing…
cristhianzl/claude-skills-czl · configs/agnostic/skills/developing-features-tdd/SKILL.md · Build a new feature using strict test-driven development — UNDERSTAND → DESIGN → RED → VERIFY RED → GREEN → VERIFY…
cristhianzl/claude-skills-czl · configs/agnostic/skills/documenting-features/SKILL.md · Produce living, DDD-aligned feature documentation as a single Markdown file with 10 fixed sections — overview…
cristhianzl/claude-skills-czl · configs/agnostic/skills/exploratory-testing/SKILL.md · Run structured exploratory testing — write a charter, time-box a session, apply heuristics and oracles to discover bugs…
cristhianzl/claude-skills-czl · configs/agnostic/skills/guarding-scope/SKILL.md · Keep every piece of work inside the scope the user asked for — and detect scope creep, gold plating, and AI slop in any…
affaan-m/ecc · .agents/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · .kiro/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · docs/es/skills/security-review/SKILL.md · Usar este skill al agregar autenticación, manejar entradas de usuario, trabajar con secretos, crear endpoints de API o…
microsoft/power-platform-skills · plugins/power-pages/skills/security-review/SKILL.md · Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report…
kklimuk/docx-cli · .claude/skills/security-review/SKILL.md · Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for…
