# Security Lens

> Apply security awareness during code review and implementation. Catches common vulnerabilities without requiring full security audit.

- Skill: `majiayu000/security-lens` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-lens`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-lens/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-lens

---


# Security Awareness Lens

When reviewing or writing code, check for:

## Input Handling

- [ ] User input validated before use
- [ ] SQL uses parameterized queries (never string concat)
- [ ] HTML output escaped to prevent XSS
- [ ] File paths validated (no path traversal)

## Authentication/Authorization

- [ ] Auth checks at controller level, not just UI
- [ ] Sensitive operations re-verify permissions
- [ ] Session tokens are httpOnly, secure, sameSite

## Data Exposure

- [ ] Logs don't contain secrets, tokens, PII
- [ ] Error messages don't leak internal details
- [ ] API responses don't include unnecessary fields

## Secrets

- [ ] No hardcoded credentials
- [ ] Secrets from environment/vault, not config files
- [ ] .gitignore covers .env, credentials

See @owasp-quick-ref.md for detailed vulnerability patterns.