security-review
Ensures code adheres to security best practices, identifying vulnerabilities in authentication, API endpoints, and sensitive data handling.
Install this skill
Security score
The security-review skill was audited on Feb 28, 2026 and we found 18 security issues across 5 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 115 | const query = `SELECT * FROM users WHERE email = '${userEmail}'` |
Template literal with variable interpolation in command context
| 149 | `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`) |
Template literal with variable interpolation in command context
| 258 | `session=${sessionId}; HttpOnly; Secure; SameSite=Strict`) |
Template literal with variable interpolation in command context
| 438 | headers: { Authorization: `Bearer ${userToken}` } |
Fetch to external URL
| 431 | const response = await fetch('/api/protected') |
Fetch to external URL
| 437 | const response = await fetch('/api/admin', { |
Fetch to external URL
| 445 | const response = await fetch('/api/users', { |
Fetch to external URL
| 455 | fetch('/api/endpoint') |
Access to .env file
| 34 | const apiKey = process.env.OPENAI_API_KEY |
Access to .env file
| 35 | const dbUrl = process.env.DATABASE_URL |
Access to .env file
| 46 | - [ ] `.env.local` in .gitignore |
Buffer.from base64 decode
| 353 | Buffer.from(signature, 'base64'), |
Buffer.from base64 decode
| 354 | Buffer.from(publicKey, 'base64') |
External URL reference
| 223 | connect-src 'self' https://api.example.com; |
External URL reference
| 489 | - [OWASP Top 10](https://owasp.org/www-project-top-ten/) |
External URL reference
| 490 | - [Next.js Security](https://nextjs.org/docs/security) |
External URL reference
| 491 | - [Supabase Security](https://supabase.com/docs/guides/auth) |
External URL reference
| 492 | - [Web Security Academy](https://portswigger.net/web-security) |
Install this skill with one command
/learn @davila7/cc-skill-security-review