Security Review

This is the checklist you run before shipping anything that touches user data, auth, or payments. It covers the usual suspects: environment variables instead of hardcoded secrets, parameterized queries to avoid SQL injection, httpOnly cookies for tokens, input validation with Zod, and CSP headers. The fail/pass code examples are actually helpful, especially the Supabase RLS policies and rate limiting setup. It's opinionated about things like never using localStorage for tokens and starting with strict CSP instead of unsafe-inline. Honestly, this reads like the security review your team should be doing anyway but probably isn't. Good reference when you're about to merge something sensitive and want to catch the obvious mistakes.

skills.sh installs: 7.6K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill security-review --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

When to Activate

Implementing authentication or authorization
Handling user input or file uploads
Creating new API endpoints
Working with secrets or credentials
Implementing payment features
Storing or transmitting sensitive data
Integrating third-party APIs

Security Checklist

1. Secrets Management

FAIL: NEVER Do This

const apiKey = "sk-proj-xxxxx"  // Hardcoded secret
const dbPassword = "password123" // In source code

PASS: ALWAYS Do This

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}