---
name: security-review
description: Security audit for code — scan for vulnerabilities, hardcoded secrets, input validation issues, injection risks, auth misconfigurations. Use when reviewing code, before merge, or on request.
---

# Security Review Skill

Based on ECC AgentShield patterns + OWASP Top 10.

## When to Use

- Before merging any code
- Code review step
- User explicitly requests security scan
- Adding auth or handling sensitive data

## Scan Checklist

### 1. Secrets Detection
- Hardcoded API keys, passwords, tokens, connection strings
- `.env` files committed (check `.gitignore`)
- AWS credentials, JWT secrets, OAuth client secrets
- Search patterns: `password\s*=\s*["']`, `api_key\s*=\s*["']`, `secret\s*=\s*["']`

### 2. Input Validation
- ALL user input validated before use
- No raw string concatenation for SQL
- HTML output escaped (XSS prevention)
- File path traversal prevention
- File upload type and size validation

### 3. Authentication & Authorization
- Protected endpoints require auth
- Role-based access control enforced server-side
- JWT tokens validated (expiration, signature)
- Session security (HttpOnly, Secure, SameSite)
- No privilege escalation paths

### 4. Data Protection
- Sensitive data encrypted at rest
- TLS in transit
- PII not logged
- Password hashing (bcrypt, argon2 — NOT md5, sha1)

### 5. Infrastructure
- HTTPS enforced
- CORS configured (not wildcard)
- Rate limiting on public endpoints
- Security headers (CSP, HSTS, X-Frame-Options)
- Dependencies scanned for CVEs

## Execution

```bash
# Quick scan for secrets
grep -rn --include='*.py' --include='*.ts' --include='*.js' --include='*.go' \
  -E '(password|secret|api_key|token)\s*=\s*["\x27][^$\{]' app/ tests/

# Check .gitignore
cat .gitignore | grep -E '\.env|credentials|secrets'

# Check dependencies for CVEs
npm audit        # Node.js
pip audit         # Python
go list -m all -json | nancy check  # Go

# Check for common injection patterns
grep -rn 'exec\(|eval\(|system(' app/
grep -rn 'SELECT.*' + app/   # SQL concatenation
grep -rn 'innerHTML\s*=' app/   # XSS
```

## Report Format

```
## Security Review: [Project/Task]
**Overall Risk**: Low / Medium / High / Critical

### Critical (must fix before deploy):
1. [Issue] at [file:line] — [recommendation]

### High (should fix):
1. [Issue] — [recommendation]

### Medium (recommended):
1. [Issue] — [recommendation]

### Verified Safe:
- [List: input validation, auth enforcement, no hardcoded secrets, etc.]

### Dependencies:
- Vulnerabilities found: X (Critical: Y, High: Z)
```