Code Review Security

This is a PR review checklist that walks through OWASP Top 10 vulnerabilities with specific patterns for Python/FastAPI and React codebases. You get code-level checks for access control issues, SQL injection, weak crypto, insecure CORS configs, and JWT misconfigurations. It writes findings to a markdown file with severity and line numbers. The examples are practical, like catching missing authorization dependencies or spotting `shell=True` in subprocess calls. It won't help with infrastructure security or incident response, just application code review. If your team reviews security-sensitive PRs and you want a structured audit pattern instead of ad hoc comments, this gives you the runthrough.

skills.sh installs: 440
GitHub stars: 8
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add hieutrtr/ai1-skills --skill code-review-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Code Review Security

When to Use

Activate this skill when:

Reviewing pull requests for security vulnerabilities
Auditing authentication or authorization code changes
Reviewing code that handles user input, file uploads, or external data
Checking for OWASP Top 10 vulnerabilities in new features
Validating that secrets are not committed to the repository
Scanning dependencies for known vulnerabilities
Reviewing API endpoints that expose sensitive data

Output: Write findings to security-review.md with severity, file:line, description, and recommendations.

Do NOT use this skill for:

Deployment infrastructure security (use docker-best-practices)
Incident response procedures (use incident-response)
General code quality review without security focus (use pre-merge-checklist)
Writing implementation code (use python-backend-expert or react-frontend-expert)