security-review: a Claude Code skill by Affaan Mustafa
For web developers adding login, payments, uploads or new API routes who want a security checklist at hand. Skip it if you need an automated scan of your code or work outside the Node web stack.
- Score
- 70of 100
- Rank
- #177of 239
- Installs
- 20.2Kon skills.sh
- Security
- Clear 3 scanners
- Updated
- 2026
- Context
- ~56tokens always
Install
npx skills add https://github.com/affaan-m/ecc --skill security-review
Run it in your terminal. View the source
Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app
What does security-review do?
security-review is a skill that gives Claude a security checklist with code examples for TypeScript web apps. It switches on when you add authentication, accept user input or uploads, handle secrets, create API endpoints or build payment features. Ten sections each pair a wrong and a right example with tick-box checks: secrets in environment variables, zod input validation, parameterized SQL, httpOnly cookies and Supabase row level security, DOMPurify and a strict CSP, CSRF tokens, express-rate-limit, log redaction, Solana wallet signature checks and npm audit. It ends with sample security tests and a pre-deployment list of seventeen items.
When should you use security-review?
Use it when
- You are adding sign-in or role checks to an API
- You are storing tokens or handling file uploads
- You want a checklist before a production deploy
Skip it when
- You want an automated vulnerability scanner
- Your stack is not Node, Next.js or Supabase
What it needs and what it can touch
What it can do
- Runs npm audit and related commands when checking dependencies
From reading its instructions, not from running it.
Why it scores 70
Strongest on upkeep (100 of 100), weakest on adoption (48).
Is security-review safe to install?
Every scanner that checked it passed it. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.
| Scanner | Result | Date |
|---|---|---|
| Gen Agent Trust Hub | Passed | Sep 20, 2026 |
| Socket | Passed | Sep 20, 2026 |
| Snyk | Low risk | Sep 20, 2026 |
Details
- Installs
- 20,191
- Repository stars
- 300,772
- Last repository change
- Tokens always loaded
- about 56
- Tokens when used
- about 3,169
- License
- MIT
- Data confidence
- High
Did it do the job for you?
Alternatives to security-review
All skills for this job-
Get security-and-hardeningsecurity-and-hardening
For web developers handling input, logins or personal data who want clear always, ask-first and never rules.
-
Get better-auth-security-best-practicesbetter-auth-security-best-practices
For developers running Better Auth who want to lock down sessions, cookies and sign-in limits before launch.
-
Get penetration-testing-with-strixpenetration-testing-with-strix
For developers who want automated pentests that prove each finding with a working exploit.
-
Get security-reviewsecurity-review
For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws.
security-review