security-review
Ensures code adheres to security best practices, identifying vulnerabilities in authentication, input handling, and sensitive data management.
Install this skill
Security score
The security-review skill was audited on Mar 8, 2026 and we found 18 security issues across 5 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 114 | const query = `SELECT * FROM users WHERE email = '${userEmail}'` |
Template literal with variable interpolation in command context
| 148 | `token=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`) |
Template literal with variable interpolation in command context
| 257 | `session=${sessionId}; HttpOnly; Secure; SameSite=Strict`) |
Template literal with variable interpolation in command context
| 437 | headers: { Authorization: `Bearer ${userToken}` } |
Fetch to external URL
| 430 | const response = await fetch('/api/protected') |
Fetch to external URL
| 436 | const response = await fetch('/api/admin', { |
Fetch to external URL
| 444 | const response = await fetch('/api/users', { |
Fetch to external URL
| 454 | fetch('/api/endpoint') |
Access to .env file
| 33 | const apiKey = process.env.OPENAI_API_KEY |
Access to .env file
| 34 | const dbUrl = process.env.DATABASE_URL |
Access to .env file
| 45 | - [ ] `.env.local` 已包含在 .gitignore 中 |
Buffer.from base64 decode
| 352 | Buffer.from(signature, 'base64'), |
Buffer.from base64 decode
| 353 | Buffer.from(publicKey, 'base64') |
External URL reference
| 222 | connect-src 'self' https://api.example.com; |
External URL reference
| 488 | - [OWASP Top 10](https://owasp.org/www-project-top-ten/) |
External URL reference
| 489 | - [Next.js Security](https://nextjs.org/docs/security) |
External URL reference
| 490 | - [Supabase Security](https://supabase.com/docs/guides/auth) |
External URL reference
| 491 | - [Web Security Academy](https://portswigger.net/web-security) |
Install this skill with one command
/learn @xu-xiang/security-review