cc-skill-security-review
This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.
Profile →npx skills add sickn33/agentic-awesome-skills --skill cc-skill-security-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Review Skill This skill ensures all code follows security best practices and identifies potential vulnerabilities. ## When to Use - Implementing authentication or authorization - Handling user input or file uploads - Creating new API endpoints - Working with secrets or credentials - Implementing payment features - Storing or transmitting sensitive data - Integrating third-party APIs ## Security Checklist ### 1. Secrets Management #### ❌ NEVER Do This ```typescript const leakedToken = "[redacted API key]" // Hardcoded secret const dbCredential = "[redacted password]" // In source code ``` #### ✅ ALWAYS Do This ```typescript const apiKey = process.env.OPENAI_API_KEY const dbUrl = process.env.DATABASE_URL // Verify secrets exist if (!apiKey) { throw new Error('OPENAI_API_KEY not configured') } ``` #### Verification Steps - [ ] No hardcoded API keys, tokens, or passwords - [ ] All secrets in environment variables - [ ] `.env.local` in .gitignore - [ ] No secrets in git history - [ ] Production secrets in hosting platform (Vercel, Railway) ### 2. Input Validation #### Always Validate User Input ```typescript import { z } from 'zod' // Define validation schema const CreateUser
- When to Use
- Security Checklist
- 1. Secrets Management
- 2. Input Validation
- 3. SQL Injection Prevention
- 4. Authentication & Authorization
- 5. XSS Prevention
- 6. CSRF Protection
- 7. Rate Limiting
- 8. Sensitive Data Exposure
- 9. Blockchain Security (Solana)
- 10. Dependency Security
- Security Testing
- Automated Security Tests
Check for vulnerabilities npm audit Fix automatically fixable issues npm audit fix Update dependencies npm update Check for outdated packages npm outdated ALWAYS commit lock files git add package-lock.json
What does the cc-skill-security-review skill do?
This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill cc-skill-security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.