security-review
Ensures code adheres to security best practices, identifying vulnerabilities in authentication, API endpoints, and sensitive data handling.
Install this skill
Security score
The security-review skill was audited on Feb 28, 2026 and we found 18 security issues across 5 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 113 | const query = `SELECT * FROM users WHERE email = '${userEmail}'` |
Template literal with variable interpolation in command context
| 147 | `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`) |
Template literal with variable interpolation in command context
| 256 | `session=${sessionId}; HttpOnly; Secure; SameSite=Strict`) |
Template literal with variable interpolation in command context
| 436 | headers: { Authorization: `Bearer ${userToken}` } |
Fetch to external URL
| 429 | const response = await fetch('/api/protected') |
Fetch to external URL
| 435 | const response = await fetch('/api/admin', { |
Fetch to external URL
| 443 | const response = await fetch('/api/users', { |
Fetch to external URL
| 453 | fetch('/api/endpoint') |
Access to .env file
| 32 | const apiKey = process.env.OPENAI_API_KEY |
Access to .env file
| 33 | const dbUrl = process.env.DATABASE_URL |
Access to .env file
| 44 | - [ ] `.env.local` in .gitignore |
Buffer.from base64 decode
| 351 | Buffer.from(signature, 'base64'), |
Buffer.from base64 decode
| 352 | Buffer.from(publicKey, 'base64') |
External URL reference
| 221 | connect-src 'self' https://api.example.com; |
External URL reference
| 487 | - [OWASP Top 10](https://owasp.org/www-project-top-ten/) |
External URL reference
| 488 | - [Next.js Security](https://nextjs.org/docs/security) |
External URL reference
| 489 | - [Supabase Security](https://supabase.com/docs/guides/auth) |
External URL reference
| 490 | - [Web Security Academy](https://portswigger.net/web-security) |
Install this skill with one command
/learn @sc30gsw/security-review