security-review
Review a design, PR, or feature for security issues before it ships. Use when asked to do a security review, security-review a change/PR, or check a feature for vulnerabilities. Produces a structured review across the common risk areas (authn/authz, input handling, secrets, data exposure, dependencies), findings ranked by severity with concrete fixes, and a ship / fix-first verdict. For code and systems you own or are authorized to review.
npx skills add mohitagw15856/pm-claude-skills --skill security-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Review Skill A security review is a focused pass for the ways a change could be abused — before it reaches production. This skill reviews a design, PR, or feature against the recurring risk areas, ranks findings by severity, and gives a clear verdict with concrete fixes. It's for code/systems you own or are authorized to review, and it complements (not replaces) automated scanners and a formal pentest. ## Required Inputs Ask for these only if they aren't already provided: - **What's under review** — the design/diff/feature, and what it does. - **Context** — the stack, where it runs, what data/permissions it touches, who can reach it (internet-facing? authenticated?). - **Sensitivity** — the assets involved (PII, credentials, money, admin capability) and the threat context. ## Output Format ### Security review: [change/feature] **Summary & verdict** — one-line read and a call: ✅ ship / 🔁 fix-first / ⛔ block, with the gating issue(s). **Review by risk area** — scan each and note findings: 1. **AuthN / AuthZ** — is identity verified, and is every action authorized (incl. object-level / IDOR, privilege escalation)? 2. **Input handling** — validation/encoding; injection (SQL
- Required Inputs
- Output Format
- Security review: [change/feature]
- Quality Checks
- Anti-Patterns
- Based On
What does the security-review skill do?
Review a design, PR, or feature for security issues before it ships. Use when asked to do a security review, security-review a change/PR, or check a feature for vulnerabilities. Produces a structured review across the common risk areas (authn/authz, input handling, secrets, data exposure, dependencies), findings ranked by severity with concrete fixes, and a ship / fix-first verdict. For code and systems you own or are authorized to review.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.