security-review
Ensures code adheres to security best practices, identifying vulnerabilities in authentication, API endpoints, and sensitive data handling.
Install this skill
Security score
The security-review skill was audited on Mar 8, 2026 and we found 18 security issues across 5 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 120 | const query = `SELECT * FROM users WHERE email = '${userEmail}'` |
Template literal with variable interpolation in command context
| 157 | `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`) |
Template literal with variable interpolation in command context
| 274 | `session=${sessionId}; HttpOnly; Secure; SameSite=Strict`) |
Template literal with variable interpolation in command context
| 468 | headers: { Authorization: `Bearer ${userToken}` } |
Fetch to external URL
| 461 | const response = await fetch('/api/protected') |
Fetch to external URL
| 467 | const response = await fetch('/api/admin', { |
Fetch to external URL
| 475 | const response = await fetch('/api/users', { |
Fetch to external URL
| 485 | fetch('/api/endpoint') |
Access to .env file
| 34 | const apiKey = process.env.OPENAI_API_KEY |
Access to .env file
| 35 | const dbUrl = process.env.DATABASE_URL |
Access to .env file
| 47 | - [ ] `.env.local` in .gitignore |
Buffer.from base64 decode
| 377 | Buffer.from(signature, 'base64'), |
Buffer.from base64 decode
| 378 | Buffer.from(publicKey, 'base64') |
External URL reference
| 236 | connect-src 'self' https://api.example.com; |
External URL reference
| 519 | - [OWASP Top 10](https://owasp.org/www-project-top-ten/) |
External URL reference
| 520 | - [Next.js Security](https://nextjs.org/docs/security) |
External URL reference
| 521 | - [Supabase Security](https://supabase.com/docs/guides/auth) |
External URL reference
| 522 | - [Web Security Academy](https://portswigger.net/web-security) |
Install this skill with one command
/learn @hummbl-dev/security-review