# Code Review

> Security-focused code review before committing Use when this capability is needed.

- Skill: `tomevault-io/code-review-251` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/code-review-251`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/code-review-251/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/code-review-251

---


# Security Code Review

Review code changes for security issues before committing.

## Purpose

This skill performs a security-focused code review to catch common vulnerabilities before they make it into the codebase. Run this before committing to self-check your changes.

## Security Checklist

When reviewing code, check for:

### Secrets & Credentials
- [ ] No hardcoded secrets (API keys, passwords, tokens)
- [ ] No AWS credentials in code
- [ ] No private keys or certificates
- [ ] Environment variables used for sensitive config

### Injection Vulnerabilities
- [ ] No SQL injection (use parameterized queries)
- [ ] No command injection (avoid shell=True, sanitize inputs)
- [ ] No LDAP injection
- [ ] No XPath injection

### Input Validation
- [ ] No path traversal (validate file paths)
- [ ] No open redirects
- [ ] User input properly sanitized
- [ ] File uploads validated

### Dependencies
- [ ] Dependencies are from trusted sources
- [ ] No wildcard version specifications
- [ ] Lock files present and updated

### General Security
- [ ] File permissions are appropriate
- [ ] No debug code left in
- [ ] Error messages don't leak sensitive info
- [ ] Logging doesn't include sensitive data

## Usage

```
/code-review
```

Run this skill before committing to perform a self-check on your changes.

## Output

The skill will:
1. Identify changed files using `git diff`
2. Review each file against the security checklist
3. Report any findings with severity levels
4. Provide remediation suggestions

## Example Findings

```
[HIGH] src/api.py:42 - Hardcoded API key detected
  → Move to environment variable: os.getenv('API_KEY')

[MEDIUM] src/db.py:15 - SQL query uses string formatting
  → Use parameterized query: cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))

[LOW] src/utils.py:8 - Debug print statement
  → Remove before committing
```

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/agairola) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->