Security Cleanup (A01:2025–A10:2025 + LLM01:2025–LLM10:2025)

What this checks

Applies fixes for security findings. Pair with /security-review to detect issues, then /security-cleanup to fix them.

Vulnerable patterns

This skill remediates, not detects. Run /security-review first.

Procedure

1. Get the findings: from the user's message, a recent /security-review output, or — if none are available — run /security-review first to produce them.

2. For each finding (highest severity first):

   • Read the cited file at the cited line
   • Read .claude/skills/<skill>/SKILL.md for the correct fix pattern
   • Apply the fix using the Edit tool
   • Use the language's idiomatic safe API (Go html/template, Python Environment(autoescape=True), Java PreparedStatement, etc.)

3. After all findings are processed, summarize what was fixed.

Rules:

• Never change observable behavior beyond removing the vulnerability
• If unsure about the correct fix, say so and skip that finding
• One Edit per finding — don't refactor surrounding code

Verification

• Each fix addresses the specific finding cited
• No fix introduces new vulnerabilities or changes business logic
• Summary lists all findings and their disposition

References

• CWE-693 (Protection Mechanism Failure)
• OWASP Web Top 10:2025
• OWASP LLM Top 10:2025