How do I install the Security Review skill?

Run npx skillmds@latest add konradcinkusz/security-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Review safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Review?

konradcinkusz (@konradcinkusz) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Review by konradcinkusz — Agent Skill

Name: Security Review
Author: konradcinkusz

Security Review

Use when performing a security review or triaging findings before launch. The repeatable method with justified N/A, the finding format, prioritization and the readiness ledger, plus the recurring rule sets: tokens in browsers, cryptographically secure random values, user-supplied paths and names, output/errors/rendering, and authorization structure. An audit whose output format changes each time cannot show whether the system is getting safer.

konradcinkusz 460dcd0 2 files · 11.9 KB Updated Sep 17, 2026

File contents

Security review: the method and the recurring rules

Read references/SECURITY-REVIEW.md before applying any of this. That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards.

Reference-architecture principles: P5.

What this standard covers

The review method
The finding format
Prioritization and the readiness ledger
Rule set: tokens in browsers
Rule set: random values
Rule set: user-supplied paths and names
Rule set: output, errors and rendering
Rule set: authorization structure
Recurring launch blockers

Checklist

Category list worked through; every N/A justified with evidence; positive findings recorded; pentest caveat stated
Findings in the standard format, each with an attack scenario
Time-windowed priorities; status ledger with context column; blocks-deploy vs before-deploy split; residual risks listed
No tokens in web storage; cookies set server-side; signature verification at every gate; header set present
CSPRNG for anything presentable as proof; password-hash parameters recorded
Path/name validation spec applied server-side, mirrored client-side
Encode at render; markdown sanitized; Swagger off in production
Deny-by-default with a short [AllowAnonymous] list; endpoint × role matrix produced; no identity-by-email; CORS origins explicit
The four recurring launch blockers checked explicitly

Generated from docs/guides/SECURITY-REVIEW.md by scripts/build-marketplace.mjs. Do not edit this file: change the source document, or its entry in catalog/marketplace.catalog.json, and re-run the generator.

---name: security-reviewdescription: Use when performing a security review or triaging findings before launch. The repeatable method with justified N/A, the finding format, prioritization and the readiness ledger, plus the recurring rule sets: tokens in browsers, cryptographically secure random values, user-supplied paths and names, output/errors/rendering, and authorization structure. An audit whose output format changes each time cannot show whether the system is getting safer.---# Security review: the method and the recurring rules**Read [`references/SECURITY-REVIEW.md`](references/SECURITY-REVIEW.md) before applying any of this.**That file is the standard; everything below it is a summary to help you decidewhether this skill applies and to check your work afterwards.Reference-architecture principles: P5.## What this standard covers- The review method- The finding format- Prioritization and the readiness ledger- Rule set: tokens in browsers- Rule set: random values- Rule set: user-supplied paths and names- Rule set: output, errors and rendering- Rule set: authorization structure- Recurring launch blockers## Checklist- [ ] Category list worked through; every N/A justified with evidence; positive findings recorded; pentest caveat stated- [ ] Findings in the standard format, each with an attack scenario- [ ] Time-windowed priorities; status ledger with context column; blocks-deploy vs before-deploy split; residual risks listed- [ ] No tokens in web storage; cookies set server-side; signature verification at every gate; header set present- [ ] CSPRNG for anything presentable as proof; password-hash parameters recorded- [ ] Path/name validation spec applied server-side, mirrored client-side- [ ] Encode at render; markdown sanitized; Swagger off in production- [ ] Deny-by-default with a short `[AllowAnonymous]` list; endpoint × role matrix produced; no identity-by-email; CORS origins explicit- [ ] The four recurring launch blockers checked explicitly---Generated from [`docs/guides/SECURITY-REVIEW.md`](https://github.com/konradcinkusz/architecture-standards/blob/main/docs/guides/SECURITY-REVIEW.md) by `scripts/build-marketplace.mjs`. Do not edit this file: change the source document, or its entry in `catalog/marketplace.catalog.json`, and re-run the generator.

Frequently asked questions