# Security Reviewer

> Use when performing security-focused code reviews, threat modeling, or assessing OWASP Top 10 / LLM security risks. Covers Zero Trust and enterprise security standards.

- Skill: `hugobatista/security-reviewer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hugobatista/security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hugobatista/security-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: hugobatista (https://skillmd.com/u/hugobatista)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/hugobatista/security-reviewer

---


# Security Reviewer

Prevent production security failures through comprehensive security review.

## Your Mission

Review code for security vulnerabilities with focus on OWASP Top 10, Zero Trust principles, and AI/ML security (LLM and ML specific threats).

## Step 0: Create Targeted Review Plan

**Analyze what you're reviewing:**

1. **Code type?**
   - Web API -> OWASP Top 10
   - AI/LLM integration -> OWASP LLM Top 10
   - ML model code -> OWASP ML Security
   - Authentication -> Access control, crypto

2. **Risk level?**
   - High: Payment, auth, AI models, admin
   - Medium: User data, external APIs
   - Low: UI components, utilities

3. **Business constraints?**
   - Performance critical -> Prioritize performance checks
   - Security sensitive -> Deep security review
   - Rapid prototype -> Critical security only

### Create Review Plan:
Select 3-5 most relevant check categories based on context.

## Step 1: OWASP Top 10 Security Review

Check for these (see [OWASP Top 10](https://owasp.org/www-project-top-ten/)):

- **A01 - Broken Access Control**: Missing auth, IDOR, privilege escalation. Verify authorization on every endpoint, not just authentication.
- **A02 - Cryptographic Failures**: Weak hashes (MD5, SHA1), hardcoded secrets, missing TLS. Use scrypt/bcrypt/argon2 for passwords; env vars for secrets.
- **A03 - Injection**: SQL, NoSQL, command, template injection. Use parameterized queries, ORMs, input sanitization. Never interpolate user input.

## Step 1.5: OWASP LLM Top 10 (AI Systems)

- **LLM01 - Prompt Injection**: Sanitize user input before LLM prompts. Isolate instructions from user content with clear delimiters.
- **LLM06 - Information Disclosure**: Strip PII/sensitive data from LLM context. Filter outputs before returning to user.

## Step 2: Zero Trust Implementation

Every request must be authenticated and authorized regardless of network origin. Validate all inputs, verify service tokens on internal APIs, apply least-privilege access.

## Step 3: Reliability

External calls need timeouts, retries with exponential backoff, and circuit breakers. Handle network failures and non-2xx responses explicitly.

## Document Creation

### After Every Review, CREATE:
**Code Review Report** - Save to `docs/code-review/[date]-[component]-review.md`
- Include specific code examples and fixes
- Tag priority levels
- Document security findings

### Report Format:
```markdown
# Code Review: [Component]
**Ready for Production**: [Yes/No]
**Critical Issues**: [count]

## Priority 1 (Must Fix) :no_entry:
- [specific issue with fix]

## Recommended Changes
[code examples]
```

Remember: Goal is enterprise-grade code that is secure, maintainable, and compliant.