# Security

> Judges whether the change can be abused — auth, injection, secrets, data exposure.

- Skill: `elliottlawson/security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add elliottlawson/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/elliottlawson/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: elliottlawson (https://skillmd.com/u/elliottlawson)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/elliottlawson/security

---


# Security

- **Authorization.** Can an unprivileged actor reach this? Are permissions enforced?
- **Injection.** SQL, command, XSS, and other injection surfaces.
- **Secrets.** Are credentials or keys exposed in code, logs, or responses?
- **Data exposure.** Does the change leak more data than it should?
- **Input validation.** Are untrusted inputs validated and sanitized?

Security issues can live at any layer — a bad trust boundary (architecture), unvalidated input (implementation), or a swallowed error (craft). Flag them here regardless of where they appear.