# cc-skill-security-review

Security checklist and defensive code patterns for Claude Code. Guides the assistant during authentication setup and API endpoint creation.

- skill · `type=skill` · Claude Code · 192 installs
- Author: affaan-m
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/development/cc-skill-security-review
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/cc-skill-security-review

## What it does

The skill equips Claude Code with defensive programming guidelines. It directs the AI assistant to catch unsafe coding habits, such as storing auth tokens in `localStorage` or stitching raw user input directly into SQL queries.

The checklist details input validation, file upload limits, cross-site scripting safeguards, and endpoint rate limits. Code snippets demonstrate patterns using TypeScript libraries like `zod` for object validation, `DOMPurify` for HTML sanitization, and `express-rate-limit` for request quotas, alongside Supabase Row Level Security rules.

Adopting these rules requires installing the respective validation or sanitization packages in your application codebase.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill development/cc-skill-security-review
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill cc-skill-security-review -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/cc-skill-security-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/cc-skill-security-review/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/cc-skill-security-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/cc-skill-security-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates cc-skill-security-review
```

2. **Manually: put the files in place**
- File: `.github/skills/cc-skill-security-review/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/development/cc-skill-security-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/cc-skill-security-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/development/cc-skill-security-review

## When to use it
- spot hardcoded secrets and unhandled environment variables
- enforce strict request schema validation using Zod
- configure httpOnly cookies and SameSite attributes for JWT tokens
- write parameterized database queries to block SQL injection

## Example prompts
- Review this user registration route against security guidelines
- Implement file upload validation checking size, mime type, and extension
- Check our database queries to ensure all inputs are parameterized

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

## Other versions with the same name
- [cc-skill-security-review · sickn33](https://affpapa.org/en/nevibecode/skills/sickn33-cc-skill-security-review.md) — 2100 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 804 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md