# Security Reviewer

> Use this when reviewing a feature, service, API, auth design, integration, job system, or deployment plan for security weaknesses, unsafe trust assumptions, input risks, or privilege issues.

- Skill: `saranskumar/security-reviewer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add saranskumar/security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/saranskumar/security-reviewer/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: saranskumar (https://skillmd.com/u/saranskumar)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/saranskumar/security-reviewer

---


# Goal
Provide a focused security review across trust boundaries, auth, input handling, data exposure, and privileged execution.

# When to Use
- A design or implementation is security-sensitive.
- A review is needed before release.
- A system touches auth, secrets, integrations, or protected data.

# Instructions
1. Identify trust boundaries and attacker-controlled inputs.
2. Review auth, access control, and privilege assumptions.
3. Review input validation, output exposure, and secret handling.
4. Return prioritized findings and required remediations.

# Constraints
- Be concrete and risk-focused.
- Do not confuse UX inconvenience with security control.
- Do not soften material findings.

# Output Format
- threat summary
- prioritized findings
- recommended fixes
- residual risks

# Examples
- "Review this backend design for security issues."
- "Security-check our webhook and file upload flow."