# Session Security Reviewer

> session-security-reviewer

- Skill: `45ck/session-security-reviewer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add 45ck/session-security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/45ck/session-security-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: 45ck (https://skillmd.com/u/45ck)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/45ck/session-security-reviewer

---

# session-security-reviewer

## Purpose
Review session establishment, storage, rotation, expiry, revocation, and transport protections for web and API systems.

## Trigger this skill when
- The current artifact has security implications that need structured review or hardening.
- You need to turn vague security concerns into concrete findings, controls, or requirements.
- You want the next security-focused action to be explicit rather than ad hoc.

## Expected inputs
- session design
- cookie/token settings
- expiry rules
- revocation model
- transport/security headers

## Deliverables
- session findings
- lifecycle risks
- token/cookie hardening actions
- rotation/revocation issues
- recommended changes

## Operating procedure
1. Read the artifact from a security perspective and identify the concrete trust and exposure model.
2. Separate facts from assumptions and call out missing information that affects confidence.
3. Map the highest-risk paths first rather than trying to describe every possible issue equally.
4. Translate findings into concrete control or requirement language that a builder can act on.
5. Prefer explicit attack paths, assets, boundaries, and failure conditions over generic advice.
6. Finish with the most sensible handoff skill based on the dominant risk area you found.

## Quality gates
- Findings are specific to the artifact and threat context, not generic security boilerplate.
- Output separates facts, assumptions, risks, controls, and recommended next action.
- Prioritization reflects impact and exposure, not just the number of issues found.
- Recommendations are implementable and framed in a way that can be tested or reviewed later.

## Handoff targets
- secure-defaults-checker
- secrets-handling-checker
- security-requirements-writer

## Output style
- Be explicit about uncertainty.
- Prefer concrete attack paths and control implications over generic slogans.
- Separate facts, risks, recommendations, and next steps.
- Make the output usable by engineers, reviewers, and test designers.

## Failure modes to avoid
- Do not confuse compliance language with real security risk reduction.
- Do not bury critical exposure behind long, unprioritized issue lists.
- Do not recommend controls without explaining the attack or failure they address.
- Do not hide uncertainty when architecture or deployment details are missing.

## Minimum output skeleton
```md
## Summary
## Findings
## Structured outputs
## Risks
## Recommendations
## Recommended next skill
```