Security Review
SkillSecurityThis skill gives your AI a set of fixed rules for spotting common security problems in code. Once added, it can review your code for missing authorization checks, unvalidated input, and ways that privileges could be escalated. You get a consistent security review without having to remember what to look for.
Available today. Use it from your connected AI after setup.
No other account needed.
After adding it, point your AI at the code you want checked, such as a file or a set of recent changes, and ask it to run a security review. It will go through the code using the built-in rules and report what it finds.
Then ask your AI: use the Security Review skill
What your AI can do with it
- Check code for missing authorization checks
- Flag input that is not properly validated
- Spot privilege escalation risks
- Review changes against a fixed set of security rules
- Apply the same checks every time code is reviewed
What this skill tells your AI
The instructions your AI receives, as published by bottelet/daybydaycrm in .claude/skills/security-review-checklist/SKILL.md and read by ahel’s review.
Purpose
Detect security risks in code during review phase. This skill does NOT enforce security. It identifies issues.
Scope
This skill evaluates:
- authorization checks (missing or bypassed)
- policy usage correctness
- privilege escalation risks
- unsafe controller or action exposure
- validation gaps on external input
Ownership Boundary
Security Review does NOT:
- implement policies
- define roles/permissions
- execute middleware logic
- enforce runtime access control
Those belong to application security layers (Policies, Middleware, Gates).
Rules
- Every sensitive action MUST have explicit authorization check
- No unguarded resource actions (create/update/delete/view)
- No direct access to privileged operations without policy validation
- Input from external sources MUST be validated before use
Escalation Principle
If a potential security issue is detected:
- assume it is a defect until proven otherwise
- prioritize security over architectural convenience
Signals
- GitHub stars
- 2k
- Forks
- 767
- Last commit
- Aug 2026
Advanced
- Catalog kind
- skill
- Gateway key
security-review-checklist- Source
- github.com/bottelet/daybydaycrm