How do I install the Security Review skill?

Run npx skillmds@latest add jimmykane/security-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Security Review skill do?

Review Firebase Security Rules and Angular application security patterns It is listed under AI & ML on SkillMD.

Is Security Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Review?

jimmykane (@jimmykane) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Review by jimmykane — Agent Skill

Name: Security Review
Rating: 4.666666666666667 (3 reviews)
Author: jimmykane

File contents

Security Review Skill

Perform security audits focusing on Firebase Security Rules and Angular application security.

Quick Commands

# Validate Firestore rules syntax
firebase deploy --only firestore:rules --dry-run

# Run Firestore rules tests
npm run test:rules

Firebase Security Rules Review

Location

Rules file: firestore.rules
Rules tests: src/firestore.rules.spec.ts

Common Vulnerabilities

Issue	Risk	Check
Missing auth check	HIGH	Every rule should check `request.auth != null`
Overly permissive writes	HIGH	Validate data shape on writes
Missing resource ownership	HIGH	Verify `request.auth.uid == resource.data.userId`
Read-only fields modified	MEDIUM	Use `!('fieldName' in request.resource.data.diff(resource.data))`
Unbounded list queries	MEDIUM	Add limits to collection reads

Security Rules Checklist

[ ] All collections require authentication
[ ] Users can only access their own data (uid check)
[ ] Admin operations check custom claims
[ ] Write operations validate data structure
[ ] Sensitive fields cannot be modified after creation
[ ] Delete operations are appropriately restricted

Testing Rules Changes

# Start emulator and run rules tests
npm run test:rules

# Or manually:
npx firebase emulators:exec --project demo-test --only firestore 'npx vitest run --config vitest.rules.config.ts'

Angular Application Security

Authentication Checks

Pattern	Location
Route guards	`src/app/authentication/`
Pro-only directive	`src/app/directives/pro-only.directive.ts`
Has-role directive	`src/app/directives/has-role.directive.ts`

Secure Coding Checklist

[ ] No hardcoded API keys in source code
[ ] Environment files excluded from git
[ ] Firebase App Check enabled
[ ] CORS configured correctly on Cloud Functions
[ ] User input sanitized before storage
[ ] Error messages don't leak sensitive info

Review Template

When performing a security review, document findings using this format:

## Security Review: [Feature/Component]

### Scope
- Files reviewed: [list]
- Rules affected: [list]

### Findings

#### [CRITICAL/HIGH/MEDIUM/LOW] - Issue Title
- **Location**: `file:line`
- **Issue**: Description
- **Risk**: Potential impact
- **Recommendation**: How to fix

---name: security-reviewdescription: Review Firebase Security Rules and Angular application security patterns---# Security Review SkillPerform security audits focusing on Firebase Security Rules and Angular application security.## Quick Commands```bash# Validate Firestore rules syntaxfirebase deploy --only firestore:rules --dry-run# Run Firestore rules testsnpm run test:rules```## Firebase Security Rules Review### Location- Rules file: `firestore.rules`- Rules tests: `src/firestore.rules.spec.ts`### Common Vulnerabilities| Issue | Risk | Check ||-------|------|-------|| Missing auth check | HIGH | Every rule should check `request.auth != null` || Overly permissive writes | HIGH | Validate data shape on writes || Missing resource ownership | HIGH | Verify `request.auth.uid == resource.data.userId` || Read-only fields modified | MEDIUM | Use `!('fieldName' in request.resource.data.diff(resource.data))` || Unbounded list queries | MEDIUM | Add limits to collection reads |### Security Rules Checklist```[ ] All collections require authentication[ ] Users can only access their own data (uid check)[ ] Admin operations check custom claims[ ] Write operations validate data structure[ ] Sensitive fields cannot be modified after creation[ ] Delete operations are appropriately restricted```### Testing Rules Changes```bash# Start emulator and run rules testsnpm run test:rules# Or manually:npx firebase emulators:exec --project demo-test --only firestore 'npx vitest run --config vitest.rules.config.ts'```## Angular Application Security### Authentication Checks| Pattern | Location ||---------|----------|| Route guards | `src/app/authentication/` || Pro-only directive | `src/app/directives/pro-only.directive.ts` || Has-role directive | `src/app/directives/has-role.directive.ts` |### Secure Coding Checklist```[ ] No hardcoded API keys in source code[ ] Environment files excluded from git[ ] Firebase App Check enabled[ ] CORS configured correctly on Cloud Functions[ ] User input sanitized before storage[ ] Error messages don't leak sensitive info```## Review TemplateWhen performing a security review, document findings using this format:```markdown## Security Review: [Feature/Component]### Scope- Files reviewed: [list]- Rules affected: [list]### Findings#### [CRITICAL/HIGH/MEDIUM/LOW] - Issue Title- **Location**: `file:line`- **Issue**: Description- **Risk**: Potential impact- **Recommendation**: How to fix```

Frequently asked questions

Security Review