Cc Skill Security Review

A solid security checklist that covers the common pitfalls: hardcoded secrets, SQL injection, XSS, and auth token mishandling. It gives you clear before/after code examples for things like parameterized queries, input validation with Zod, and proper cookie settings. The Supabase RLS examples are helpful if you're in that ecosystem. The file upload validation section alone could save you from several bad bugs. It's comprehensive without being overwhelming, though some sections cut off abruptly. Best used as a reference when you're implementing anything that touches user input, authentication, or external APIs. The checklists are genuinely useful for code review.

skills.sh installs: 1.8K
GitHub stars: 43.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add sickn33/antigravity-awesome-skills --skill cc-skill-security-review --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Review Skill

This skill guides review of security practices and potential vulnerabilities; no checklist ensures all code is secure.

Detailed Guide

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

When to Use

Implementing authentication or authorization
Handling user input or file uploads
Creating new API endpoints
Working with secrets or credentials
Implementing payment features
Storing or transmitting sensitive data
Integrating third-party APIs

Security Checklist

1. Secrets Management

❌ NEVER Do This

const leakedToken = "[redacted API key]"  // Hardcoded secret
const dbCredential = "[redacted password]" // In source code

✅ ALWAYS Do This

const apiKey = process.env.OPENAI_API_KEY
const dbUrl = process.env.DATABASE_URL

// Verify secrets exist
if (!apiKey) {
  throw new Error('OPENAI_API_KEY not configured')
}

SKILL.md on GitHub