Agent Security Review Agent Skill

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

3k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

505

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI --skill agent-security-review

What comes with it

11 477 bytes besides the instruction

sub-skills/1-secrets-management.md

sub-skills/10-dependency-security.md

sub-skills/2-input-validation.md

sub-skills/3-sql-injection-prevention.md

sub-skills/4-authentication-authorization.md

sub-skills/5-xss-prevention.md

sub-skills/6-csrf-protection.md

sub-skills/7-rate-limiting.md

sub-skills/8-sensitive-data-exposure.md

sub-skills/9-blockchain-security-solana.md

sub-skills/automated-security-tests.md

The instruction itself

15 sections, as written by the author

Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

When to Activate

Implementing authentication or authorization
Handling user input or file uploads
Creating new API endpoints
Working with secrets or credentials
Implementing payment features
Storing or transmitting sensitive data
Integrating third-party APIs

Security Checklist

🧠 Knowledge Modules (Fractal Skills)

1. 1. Secrets Management

2. 2. Input Validation

3. 3. SQL Injection Prevention

4. 4. Authentication & Authorization

5. 5. XSS Prevention

6. 6. CSRF Protection

7. 7. Rate Limiting

8. 8. Sensitive Data Exposure

9. 9. Blockchain Security (Solana)

10. 10. Dependency Security

11. Automated Security Tests

Other skills for the same job

different authors, same section of the catalogue

Solidity Security

by ComeOnOliver

×2

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Cross Border Ecommerce

by nexscope-ai

×1

Cross-border e-commerce expansion advisor. Scores target markets on 8 weighted dimensions (market size, ecommerce penetration, competition, regulatory complexity, logistics infrastructure, payment ecosystem, cultural distance, IP protection), compares 5 fulfillment models with cost and transit data, provides country-by-country tax/duty compliance guides (EU VAT/IOSS, UK VAT, US sales tax, CA GST, AU GST, JP consumption tax), maps local payment preferences by market, and builds a phased expansion roadmap. No API key required.

9k tokens

Kanchi Dividend Review Monitor

by BaggaT236

×1

Monitor dividend portfolios with Kanchi-style forced-review triggers (T1-T5) and convert anomalies into OK/WARN/REVIEW states without auto-selling. Use when users ask for 減配検知, 8-Kガバナンス監視, 配当安全性モニタリング, REVIEWキュー自動化, or periodic dividend risk checks.

9k tokens scripts

Cosmos Vulnerability Scanner

by trailofbits

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

39k tokens

Configure Auth

by dotnet

> Add authentication and authorization to a Blazor Web App, accounting for the app's render mode. USE WHEN the user needs [Authorize] on pages, AuthorizeView, role or policy-based access, login/logout Identity pages, or AuthenticationStateProvider. Also USE WHEN auth state is null after WebAssembly loads, SignInManager throws in an interactive component, <NotAuthorized> content never renders in static SSR, or HttpContext.User is null in an interactive component. DO NOT USE for general component authoring (see author-component), for prerendering concerns unrelated to auth (see support-prerendering), or for managing non-auth cascading state (see coordinate-components).

2k tokens

Hunt Websocket

by elementalsouls

Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.

4k tokens

Web3 Audit

by elementalsouls

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

6k tokens

How to use it

Copy the folder

Take dokhacgiakhoa/agent-security-review from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.