# Security Review

> Review current code against the repository Security overlay; report evidence and remedies. Use when the user types /security-review.

- Skill: `blockmatic/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add blockmatic/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/blockmatic/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: blockmatic (https://skillmd.com/u/blockmatic)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/blockmatic/security-review

---


## Purpose and inputs

Review the specified diff or tree for security defects against the repo Security overlay and existing tests. Read-only unless fixes are requested. Do not invent CORS, encryption, or password policy.

## Steps

1. Load `/f-security` and `SECURITY.md` (or the instance path). Use that bar.
2. Check authn/authz, input validation, secret handling, and data exposure on the changed paths.
3. Validate each suspected issue with a trigger and consequence. Skip invented CVEs and timings.
4. If a finding implies a new policy, escalate to `/f-security` instead of encoding it here.

## Verification

- [ ] Findings have file/line and an execution path.
- [ ] Overlay thresholds were not expanded.
- [ ] No unsolicited commit.

## Handoff

Report defects, suggested remedies, and policy questions for `/f-security`.