# Security Review

> Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.

- **Type:** Skill
- **Install:** `agentstack add skill-icodecraft-anti-slop-security-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [iCodeCraft](https://agentstack.voostack.com/s/icodecraft)
- **Installs:** 0
- **Category:** [Finance & Payments](https://agentstack.voostack.com/c/finance-and-payments)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [iCodeCraft](https://github.com/iCodeCraft)
- **Source:** https://github.com/iCodeCraft/anti-slop/tree/main/skills/security-review

## Install

```sh
agentstack add skill-icodecraft-anti-slop-security-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Review

Review the current change like a security-minded senior. Prefer concrete findings over generic advice.

## Scope

Focus on the diff and directly related call paths. Do not audit the whole repo unless asked.

## Checklist

### Auth & access

- [ ] Every sensitive action checks authentication **and** authorization
- [ ] IDs from the client are not trusted for ownership (`userId` in body ≠ proof)
- [ ] Admin/debug routes are gated; no "temporary" open endpoints

### Input & data

- [ ] User input is validated at the boundary (type, length, allowlist)
- [ ] SQL/NoSQL/search queries are parameterized — no string concat
- [ ] HTML/Markdown/user content is escaped or sanitized where rendered
- [ ] File uploads: size limits, type allowlist, stored outside web root, randomized names
- [ ] Path joins cannot escape intended directories (`../`)

### Secrets & config

- [ ] No secrets in source, logs, client bundles, or example env files with real values
- [ ] New env vars documented; defaults are safe for production
- [ ] Tokens/passwords not written to analytics or error trackers

### Network & server

- [ ] Outbound fetches do not accept raw user URLs without allowlisting (SSRF)
- [ ] CORS is least-privilege; credentials only when required
- [ ] Cookies: `HttpOnly`, `Secure`, `SameSite` where applicable

### Dangerous APIs

- [ ] No `eval`, `dangerouslySetInnerHTML`, shell `exec` with unsanitized input
- [ ] Deserialization of untrusted data is avoided or hardened
- [ ] Crypto/auth libraries are standard — no home-rolled JWT/crypto

## Output format

Group findings:

| Severity | Rule | Where | Why it matters | Fix |
|----------|------|-------|----------------|-----|
| Critical / High / Medium / Low / Note | short name | `file:line` or symbol | 1 sentence | concrete change |

End with:

- **Blockers** — must fix before merge
- **Safe to ship with follow-ups** — optional

If no issues: say so explicitly and list what you checked.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [iCodeCraft](https://github.com/iCodeCraft)
- **Source:** [iCodeCraft/anti-slop](https://github.com/iCodeCraft/anti-slop)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-icodecraft-anti-slop-security-review
- Seller: https://agentstack.voostack.com/s/icodecraft
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.