How does it handle sensitive information like API keys?

The skill enforces strict protocols against hardcoded secrets, providing patterns for using environment variables and verifying their presence safely.

Can it help with frontend security?

Absolutely. It covers XSS prevention via DOM purification, Content Security Policy (CSP) headers, and secure cookie management for tokens.

What is the primary purpose of the Security Review skill?

It provides Claude with a comprehensive set of security patterns and checklists to audit code for vulnerabilities and ensure compliance with security best practices.

Does this skill work with modern frameworks?

Yes, it includes specific implementation patterns for Next.js, React, Supabase, and even blockchain-specific logic for Solana.

Does it include database security?

Yes, it focuses on parameterized queries to prevent SQL injection and properly configuring Row Level Security (RLS) for database access.

Security Review

Name: Security Review
Author: xu-xiang

byxu-xiang

•

Security & Testing

Performs comprehensive security audits and provides implementation patterns for authentication, input validation, and secret management.

The Security Review skill is a specialized capability for Claude Code designed to ensure applications meet high security standards. It provides a structured framework for auditing codebases, focusing on critical areas such as SQL injection prevention, XSS mitigation, secure authentication flows, and sensitive data handling. By integrating industry best practices (OWASP) and framework-specific patterns for Next.js, Supabase, and Solana, it helps developers identify vulnerabilities early in the development lifecycle and implement robust defense mechanisms like rate limiting and Content Security Policies.

Key Features

01Standardized input validation patterns using Zod and secure file upload guards

02Detailed security checklists for authentication, authorization, and session management

03Automated prevention strategies for SQL injection, XSS, and CSRF attacks

0461 GitHub stars

05Secure secret management protocols and environment variable validation

06Specialized blockchain security checks for Solana wallet and transaction verification

Use Cases

01Refactoring legacy code to replace hardcoded secrets with secure environment variables

02Implementing secure-by-default Row Level Security (RLS) in Supabase or PostgreSQL environments

03Auditing new API endpoints for authorization leaks and parameter tampering

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add xu-xiang/everything-claude-code-zh security-review

For use in Claude.ai and ChatGPT

Download Skill