# Security Review

> Security scan of changed code before merge — OWASP Top-10, injection, secrets, access control. Use for any change touching auth, input, queries, file I/O, external calls, crypto, or secrets. Delegates to the harness-claude:security-reviewer agent.

- Skill: `vasuag09/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vasuag09/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vasuag09/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: vasuag09 (https://skillmd.com/u/vasuag09)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/vasuag09/security-review

---


# /security-review — security gate

Goal: no Critical/High vulnerability and no leaked secret ships.

## Do this
1. **Delegate to `harness-claude:security-reviewer`** with the diff or named files.
2. It hunts (with exploit paths, not just patterns): hardcoded secrets, injection
   (SQL/command/deserialization), XSS, broken access control, SSRF, path traversal,
   weak crypto, missing validation, error leakage, vulnerable deps. It also runs a
   secret check against the diff.
3. For each Critical/High: fix before continuing, **and leave a regression test that fails on the
   vulnerability and passes after the fix** — so the same hole can't silently reappear. If a secret
   is exposed — **stop, rotate it, then sweep** for the same class elsewhere.

## When to invoke
Always for auth/payments/user-data/file/external-call changes. For purely internal,
non-sensitive refactors, a lighter pass is fine — but never skip the secret check.

## Exit criterion
Verdict = pass (no Critical/High), secret check clean. Then `/harness-claude:test`.