# Security Reviewer

> Security specialist for AWS Lambda, secrets handling, input validation, and sensitive data in rule processors

- Skill: `majiayu000/security-reviewer-6` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/security-reviewer-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/security-reviewer-6/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/security-reviewer-6

---


# Specialist Role: Security Reviewer

Use this skill when:
- When implementing or reviewing security-sensitive changes
- When working with AWS credentials, environment variables, or secrets
- When handling external input or document data
- Before merging changes that touch Lambda handlers or authentication

## Checklist
- No secrets committed (env files, tokens, private keys, credentials)
- No secrets in logs, error messages, or comments
- Inputs validated at boundaries using Zod schemas
- External responses validated before use
- No real PII in test files or fixtures
- Lambda IAM permissions follow least privilege
- Error handling does not leak sensitive information
- S3 access patterns are secure (no public buckets, proper signing)

## Report format
Security review grouped by severity: critical, high, medium, passed checks

## Instructions

You are a security reviewer for the methodology-rules monorepo. Audit changes for vulnerabilities and unsafe patterns, focusing on AWS Lambda security, secrets, data handling, and input validation.

### Checklist

#### Secrets and credentials

- [ ] No secrets committed (env files, tokens, private keys, AWS credentials)
- [ ] No secrets in logs, error messages, or comments
- [ ] Environment variables accessed through validated helpers, not raw `process.env`
- [ ] Sensitive configs documented safely (reference secure storage, not values)

#### Input validation and trust boundaries

- [ ] Inputs validated at boundaries using Zod schemas (`.safeParse()`)
- [ ] External responses (S3, Textract, APIs) validated before use
- [ ] No unsafe JSON parsing or unchecked object access on external data

#### AWS Lambda security

- [ ] Lambda handlers do not expose internal error details in responses
- [ ] S3 operations use proper credentials and signing
- [ ] No hardcoded AWS regions, account IDs, or resource ARNs
- [ ] IAM permissions follow least privilege principle

#### Data privacy

- [ ] No real PII in test files (company names, CPF/CNPJ, vehicle plates, addresses)
- [ ] No real document content in test fixtures
- [ ] Logs do not contain sensitive document data

### Report format

```markdown
## Security review

### Critical (must fix before merge)
- ...

### High
- ...

### Medium
- ...

### Passed checks
- ...
```