How do I install the Hotspots skill?

Run npx skillmds@latest add thejefflarson/hotspots in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hotspots safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hotspots?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hotspots free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Hotspots?

thejefflarson (@thejefflarson) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hotspots by thejefflarson — Agent Skill

Name: Hotspots
Author: thejefflarson

Hotspots

Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.

File contents

Security Hotspot Analysis (A06:2025)

What this checks

Maps security-sensitive code so reviewers know where to focus. Missed hotspots mean entire attack surfaces go unreviewed.

Single source of truth: this skill delegates to the hotspot-mapping subagent in .claude/agents/hotspot-mapping.md. The subagent's JSON output is the canonical hotspot shape; this skill adds an architecture summary and renders the result as a priority table.

Vulnerable patterns

This skill does not target a single antipattern — the hotspot-mapping subagent identifies areas where vulnerabilities are statistically most likely (trust boundaries, auth/sessions, access control, data layer, crypto/secrets, external calls). See the agent's category taxonomy for the full list.

Procedure

Step 1 — Architecture summary. Read README*, ARCHITECTURE*, docs/, SECURITY*, and CONTRIBUTING*. Produce a 3-6 bullet summary: what the system does, major components, trust boundaries, auth model, data stores, external integrations. Without this framing the table below is just a list of files.

Step 2 — Dispatch the subagent. Use the Agent tool to dispatch one hotspot-mapping subagent. Pass it the architecture summary as context. The subagent returns a JSON array of hotspots, each with file, lines, name, category, priority, why.

Step 3 — Render. Display the architecture summary, then the hotspots as a Markdown priority table. Sort rows by priority (Critical → High → Medium), then by category, then by file. Do not show the raw JSON.

Report shape:

## Architecture summary

- <bullet 1>
- <bullet 2>
- ...

## Hotspots

| Priority | Category | File | Lines | What |
|----------|----------|------|-------|------|
| Critical | AUTH & SESSIONS | src/auth/oauth.py | 60-72 | reads redirect_uri from OAuth response without validating against the registered callback list |
| Critical | DATA LAYER | src/api/handlers/users.py | 42-58 | concatenates request.args['q'] into a raw SQL LIKE clause |
| ...

---

*Run the matching auto-invoking skill against each hotspot, or
launch `/security-review` for a full audit.*

Verification

One hotspot-mapping subagent was dispatched
Architecture summary precedes the table (3-6 bullets from the repo's own documentation)
Output table has Priority | Category | File | Lines | What columns
Rows are sorted by priority (Critical first)
At least one hotspot in each broad category present in the repo (auth, data layer, etc.) is represented — recall matters more than padding

References

CWE-693 (Protection Mechanism Failure)
CWE-657 (Violation of Secure Design Principles)
OWASP A06:2025 Insecure Design

---name: hotspotsdescription: Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.---# Security Hotspot Analysis (A06:2025)## What this checksMaps security-sensitive code so reviewers know where to focus.Missed hotspots mean entire attack surfaces go unreviewed.Single source of truth: this skill delegates to the`hotspot-mapping` subagent in `.claude/agents/hotspot-mapping.md`. Thesubagent's JSON output is the canonical hotspot shape; this skilladds an architecture summary and renders the result as a prioritytable.## Vulnerable patternsThis skill does not target a single antipattern — the`hotspot-mapping` subagent identifies areas where vulnerabilitiesare statistically most likely (trust boundaries, auth/sessions,access control, data layer, crypto/secrets, external calls). Seethe agent's category taxonomy for the full list.## Procedure**Step 1 — Architecture summary.** Read `README*`, `ARCHITECTURE*`,`docs/`, `SECURITY*`, and `CONTRIBUTING*`. Produce a 3-6 bulletsummary: what the system does, major components, trust boundaries,auth model, data stores, external integrations. Without thisframing the table below is just a list of files.**Step 2 — Dispatch the subagent.** Use the **Agent** tool todispatch one `hotspot-mapping` subagent. Pass it the architecturesummary as context. The subagent returns a JSON array of hotspots,each with `file`, `lines`, `name`, `category`, `priority`, `why`.**Step 3 — Render.** Display the architecture summary, then thehotspots as a Markdown priority table. Sort rows by priority(Critical → High → Medium), then by category, then by file. Donot show the raw JSON.Report shape:```## Architecture summary- <bullet 1>- <bullet 2>- ...## Hotspots| Priority | Category | File | Lines | What ||----------|----------|------|-------|------|| Critical | AUTH & SESSIONS | src/auth/oauth.py | 60-72 | reads redirect_uri from OAuth response without validating against the registered callback list || Critical | DATA LAYER | src/api/handlers/users.py | 42-58 | concatenates request.args['q'] into a raw SQL LIKE clause || ...---*Run the matching auto-invoking skill against each hotspot, orlaunch `/security-review` for a full audit.*```## Verification- [ ] One `hotspot-mapping` subagent was dispatched- [ ] Architecture summary precedes the table (3-6 bullets from the repo's own documentation)- [ ] Output table has `Priority | Category | File | Lines | What` columns- [ ] Rows are sorted by priority (Critical first)- [ ] At least one hotspot in each broad category present in the repo (auth, data layer, etc.) is represented — recall matters more than padding## References- CWE-693 ([Protection Mechanism Failure](https://cwe.mitre.org/data/definitions/693.html))- CWE-657 ([Violation of Secure Design Principles](https://cwe.mitre.org/data/definitions/657.html))- [OWASP A06:2025 Insecure Design](https://owasp.org/Top10/A06_2021-Insecure_Design/)

Frequently asked questions