What does this skill do?

Skill Code Security Review automatically audits your code for critical vulnerabilities such as SQL injection, XSS, secret leakage, and weak authentication, applying an OWASP-based checklist before deployment to production. It scans every layer of the application—from secret management to dependencies—and generates a structured report with findings classified by severity, reference fix code, and specific verification steps.

Endpoint Pre-Deployment
Review new endpoints, authentication, or payment integrations before deploying them to production.
Secret Management and Authentication
Detects hard-coded secrets, tokens in localStorage, and insecure cookie settings.
Input Validation and Injection
Check schemas with Zod, parameterized queries, and SQL injection prevention in Supabase and Node.
Reviewing Pull Requests
Audit PRs that affect business logic or permissions and document any outstanding security technical debt.

Usage examples

🚀 Pre-deployment
Check the POST endpoint /api/users before deploying to production and let me know if there are any critical vulnerabilities.
🔐 Cookies and RLS
Audit the session cookie settings and RLS policies for Supabase in the authentication module.
🧪 Safety Tests
Generate automated tests that verify rate limiting, rejection of invalid payloads, and access without authentication.
📋 PR Review
Please review this pull request regarding user permissions and provide me with a report listing the severity of each finding.

Features

OWASP Checklist by Layer Go through secrets, input validation, SQL injection, auth/authz, XSS, CSRF, rate limiting, and dependencies in order.
Structured report consisting of three sections Classify findings as "Approved," "Blockers," and "Technical Debt" by severity, file, and affected line.
Corrected reference code It provides corrected code snippets for each vulnerability found, ready to be implemented.
Automated Verification Tests It generates concrete evidence confirming that each safety control actually works—not just appears to be safe.
Compatible with Next.js, Supabase, and Node Proven patterns for serverless, Supabase RLS, middleware, and Next.js API routes.

Frequently asked questions

The skill is optimized for Next.js, Supabase, Node, and serverless environments, but the OWASP checklist applies to any web application.
No. The skill works directly in Claude Code or Cowork by analyzing your source code. You just need to have the files accessible in the project.
Mark the vulnerability as critical or high, specify the affected file and line, provide the corrected reference code, and recommend against deployment until the issue is resolved.
Yes. It's ideal for reviewing PRs that involve business logic, permissions, or sensitive integrations before merging them.
Code Security Review — Vulnerability Audit with Claude AI

¿Prefieres escuchar el contenido? Genera la narración de audio con un clic.