# Review Code for Security Fundamentals

Security mistakes often appear in common areas like authentication, authorization, input handling, and data exposure. This skill gives Claude, Codex, and Claude Code a focused checklist for finding those risks during review.

## Install

```bash
npx skillstore add danielpodolsky/security-fundamentals
```

## Metadata

- Status: approved
- Slug: danielpodolsky-security-fundamentals
- Skillstore revision: r1
- Version status: missing
- Tree hash: 74de1557f697e08209b30f66463127c39a01ab5d4d96a41130d197b43903dd20
- Author: DanielPodolsky
- GitHub username: DanielPodolsky
- License: MIT
- Repository: https://github.com/DanielPodolsky/mentor-spec/tree/main/.claude/skills/fundamentals/security
- Ref: 7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, env\_access
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/danielpodolsky-security-fundamentals
- Manifest: https://skillstore.pages.dev/api/skills/danielpodolsky-security-fundamentals/manifest

## Capabilities

- Applies a security checklist to authentication, authorization, input handling, database queries, file uploads, APIs, and response data.
- Highlights OWASP Top 10 risks with unsafe and safer examples.
- Prompts reviewers to ask ownership, trust, exposure, secrets, and injection questions.
- Lists red flags such as dynamic code execution, innerHTML with user data, missing rate limits, broad CORS, and weak password hashing.
- Provides a pre-deploy checklist covering validation, HTTPS, CSRF, rate limiting, sensitive data, authorization, and security headers.

## Use Cases

- Review a new API endpoint: Check input validation, authorization, sensitive response fields, rate limiting, and security headers before merge.
- Mentor junior engineers: Use Socratic questions to guide engineers toward secure reasoning without simply giving answers.
- Prepare for production deployment: Run through the deploy checklist to confirm secrets, HTTPS, CSRF, injection defenses, and access controls are addressed.

## Prompt Templates

### Check this endpoint

```
Use the security fundamentals checklist to review this endpoint. Focus on input validation, authorization, and sensitive data exposure.
```

### Review authentication changes

```
Review these authentication changes for password handling, token expiry, secure transmission, logging, and brute-force protections.
```

### Audit access control paths

```
Apply the security fundamentals skill to these protected routes. Identify missing ownership checks, role checks, and server-side authorization gaps.
```

### Prepare a security pre-deploy review

```
Run a pre-deploy security review using this checklist. Group findings by injection, XSS, CSRF, data exposure, authentication, authorization, and misconfiguration.
```

## Limitations

- It is a review guide, not an automated vulnerability scanner.
- It does not run tests, inspect dependencies, or verify runtime configuration by itself.
- It focuses on common web application risks and may not cover specialized threat models.
- It depends on the reviewer to apply the checklist to the relevant code paths.

## Best Practices

- Use the checklist before merging changes that handle users, credentials, files, or API data.
- Ask ownership and trust questions for every protected resource.
- Pair each unsafe pattern with a safer implementation recommendation.

## Anti Patterns

- Treating the checklist as proof that code is secure without reviewing the actual implementation.
- Relying on client-side validation or client-side authorization as the main defense.
- Ignoring logs, URLs, and error messages when checking for sensitive data exposure.

## Security Audit

- Audited at: 2026-07-09T01:33:31.878\+00:00
- Summary: All static findings are false positives caused by Markdown examples in a defensive security checklist. The skill warns against unsafe patterns such as eval, innerHTML, weak password hashing, and SQL string interpolation; no executable code, prompt injection attempt, data exfiltration intent, or command execution behavior was found.

## Stats

- Views: 256
- Downloads: 8
- Favorites: 0
- Popularity score: 0