---
name: x-cmd/security-review
source: https://app.decimal.ai/s/x-cmd-security-review@1/SKILL.md
source_sha256: 3d1cf43cbd2e
---

# Security Reviewer

## Trigger

Use when:
- User says `/security-review`
- Changes involve authentication, authorization, cryptography, or input handling
- User explicitly asks for a security audit

Do NOT use when:
- General code review without security focus (use `/review`)
- Performance concerns (use `/optimize`)

## Steps

### Step 1: Gather Context

```bash
git diff main..HEAD
git diff --name-only main..HEAD
```

Check dependency changes if relevant:
```bash
cat package.json  # or pyproject.toml, go.mod, etc.
```

### Step 2: Scan for Risk Patterns

| Pattern | Risk |
|---------|------|
| User input without validation | Injection |
| `eval()`, `exec()`, `shell_exec()` | Command injection |
| SQL concatenation | SQL injection |
| `innerHTML`, `dangerouslySetInnerHTML` | XSS |
| Weak crypto (MD5, SHA1 for passwords) | Cryptographic failure |
| Hardcoded secrets | Secret exposure |
| File ops with user paths | Path traversal |
| Missing rate limiting | Brute force |

### Step 3: Verify Checklist

- [ ] All user inputs validated/sanitized
- [ ] Authentication flow proper
- [ ] Authorization checks present
- [ ] No weak cryptography
- [ ] No hardcoded credentials
- [ ] Output encoded to prevent XSS
- [ ] Rate limiting on APIs
- [ ] Sensitive data not logged

### Step 4: Generate Report

Use the output format below.

## Output Format

```markdown
## Security Review

### Scope
Files: N | Lines changed: +N/-N

### Findings

#### 🔴 Critical
[Description, location, exploit scenario, fix]

#### 🟠 High
[...]

#### 🟡 Medium
[...]

#### 🟢 Info
[...]

### Summary
Total: N | Critical: N | High: N | Medium: N

## Recommendations
1. [Priority fix]
2. [Next steps]
```

## Constraints

- If no vulnerabilities found, state "No critical or high severity issues found" explicitly
- Do NOT attempt to exploit; only static analysis
- Flag for deeper audit if architecture-level security concerns found