# Security Review

> Security checklist for code changes with severity classification

- **Type:** Skill
- **Install:** `agentstack add skill-mshadmanrahman-pm-pilot-security-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [mshadmanrahman](https://agentstack.voostack.com/s/mshadmanrahman)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [mshadmanrahman](https://github.com/mshadmanrahman)
- **Source:** https://github.com/mshadmanrahman/pm-pilot/tree/main/skills/dev/security-review
- **Website:** https://github.com/mshadmanrahman/pm-pilot#readme

## Install

```sh
agentstack add skill-mshadmanrahman-pm-pilot-security-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Review

Systematic security checklist for code changes. Catch vulnerabilities before they ship.

## When to Use

- After writing authentication or authorization code
- After handling user input (forms, query params, file uploads)
- After creating or modifying API endpoints
- After touching secrets, tokens, or credentials
- Before any commit that touches security-sensitive code

## Procedure

### Step 1: Identify Scope

Determine which checks apply based on changed files:
- Auth code: full checklist
- API endpoints: input validation, injection, rate limiting
- Frontend: XSS, CSRF
- Config/infra: secrets, permissions

### Step 2: Run Checklist

| Check | Severity | What to Look For |
|-------|----------|------------------|
| Hardcoded secrets | CRITICAL | API keys, passwords, tokens in source |
| SQL injection | CRITICAL | String concatenation in queries |
| Auth bypass | CRITICAL | Missing auth checks on protected routes |
| XSS | HIGH | Unsanitized user input in HTML output |
| CSRF | HIGH | Missing CSRF tokens on state-changing requests |
| Input validation | HIGH | Unvalidated user input passed to logic |
| Rate limiting | MEDIUM | Endpoints without rate limits |
| Error leaks | MEDIUM | Stack traces or internal details in responses |
| Authz checks | HIGH | Missing permission verification |
| Dependency vulns | MEDIUM | Known CVEs in dependencies |

### Step 3: Scan Code

```bash
# Check for hardcoded secrets (patterns)
grep -rn "password\s*=\s*['\"]" --include="*.{ts,js,py,go}" .
grep -rn "api_key\s*=\s*['\"]" --include="*.{ts,js,py,go}" .
grep -rn "secret\s*=\s*['\"]" --include="*.{ts,js,py,go}" .

# Check for SQL string concatenation
grep -rn "SELECT.*+.*FROM\|INSERT.*+.*INTO" --include="*.{ts,js,py,go}" .

# Check dependency audit
npm audit 2>/dev/null || pip-audit 2>/dev/null || true
```

### Step 4: Report

```
Security Review: {scope description}

CRITICAL:
- {finding with file:line and fix}

HIGH:
- {finding with file:line and fix}

MEDIUM:
- {finding or "none"}

LOW:
- {finding or "none"}

Verdict: PASS | BLOCKED ({count} CRITICAL issues)
```

## Blocking Rules

- CRITICAL: Must fix before commit. No exceptions.
- HIGH: Must fix before PR merge. Document if deferring.
- MEDIUM: Fix when possible. Track in backlog if deferring.
- LOW: Informational. Fix at convenience.

## Output Format

```
Security Review: User authentication endpoints

CRITICAL: none
HIGH:
- src/api/login.ts:42 - Missing rate limiting on login endpoint
  Fix: Add express-rate-limit middleware (max 5 attempts/min)
MEDIUM:
- src/api/profile.ts:18 - Error response includes stack trace
  Fix: Use generic error message in production
LOW: none

Verdict: PASS (0 CRITICAL, 1 HIGH to fix before merge)
```

## Rules

- Run on every commit that touches auth, input, or API code
- CRITICAL findings stop all work until fixed
- If secrets are found in code, rotate them immediately
- Never suppress findings; document accepted risks explicitly
- Check both new code AND existing code in modified files

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mshadmanrahman](https://github.com/mshadmanrahman)
- **Source:** [mshadmanrahman/pm-pilot](https://github.com/mshadmanrahman/pm-pilot)
- **License:** MIT
- **Homepage:** https://github.com/mshadmanrahman/pm-pilot#readme

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mshadmanrahman-pm-pilot-security-review
- Seller: https://agentstack.voostack.com/s/mshadmanrahman
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.