# Security Review Checklist

> Static review rules for authorization, validation, and privilege escalation risks

- Skill: `bottelet/security-review-checklist` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bottelet/security-review-checklist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bottelet/security-review-checklist/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: bottelet (https://skillmd.com/u/bottelet)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bottelet/security-review-checklist

---


# Security Review

## Purpose

Detect security risks in code during review phase.
This skill does NOT enforce security. It identifies issues.

---

## Scope

This skill evaluates:

- authorization checks (missing or bypassed)
- policy usage correctness
- privilege escalation risks
- unsafe controller or action exposure
- validation gaps on external input

---

## Ownership Boundary

Security Review does NOT:

- implement policies
- define roles/permissions
- execute middleware logic
- enforce runtime access control

Those belong to application security layers (Policies, Middleware, Gates).

---

## Rules

- Every sensitive action MUST have explicit authorization check
- No unguarded resource actions (create/update/delete/view)
- No direct access to privileged operations without policy validation
- Input from external sources MUST be validated before use

---

## Escalation Principle

If a potential security issue is detected:

- assume it is a defect until proven otherwise
- prioritize security over architectural convenience