Security Review Checklist Runner skill for Claude and Codex

Security Review Checklist Runner as an AI skill. It asks for The change, What the app does, Stack and 3 more, then does the rest. Free to install in Claude or…

Install it once and Claude or Codex runs it for you. When your request matches, your AI loads the skill, asks for anything it is missing, and works through the template itself. Prefer to fill it in by hand? See the full prompt template.

Download the skill (.zip) · View SKILL.md

When it is used

Use when a code change touches login, user input, secrets, stored data, or payments and needs a severity-ranked security pass before merge. Do not use for a full penetration test or a review of infrastructure and network configuration. Related topics: coding, technical.

What it will ask you for

• The change (longer free text)
• What the app does (longer free text)
• Stack (free text, e.g. "Framework and database")
• Areas to cover (choose any: Authentication, Authorization, Input validation, Secrets, Data exposure, Payments, Dependencies)
• Handles payments or personal data (choose one: Yes, No)
• Reporting threshold (choose one: Everything, Medium and above, High and critical only)

How it works

1. Read the whole change and note every entry point, data store, and external call it adds or alters, so the review has a map.
2. Check each selected area against that map, tracing every untrusted value from where it enters to where it is used.
3. Write each finding with file and line, the realistic attack in one sentence, and a severity from critical to low.
4. Drop findings the framework already prevents and those below the chosen reporting threshold, keeping the list short enough to act on.
5. Add a concrete fix for every remaining finding and list the areas checked that came back clean.

What you get

A findings table ordered by severity with file, line, attack, and fix, followed by a short list of areas checked with nothing found.

What it watches out for

• Flagging every missing header or hypothetical flaw, which buries the one real injection under noise.
• Checking the new code in isolation and missing that an old route now exposes the new data.
• Trusting a client-side price or role check, when the server is the only place the rule holds.

How to install

Claude.ai and the Claude desktop app

1. Download the skill .zip.
2. Open Settings, then Capabilities, and find Skills.
3. Choose Upload skill and select the .zip.
4. Ask Claude for help with the task. It loads the skill when your request matches.

Claude Code

1. Download the skill .zip.
2. Unzip it into ~/.claude/skills/ (or .claude/skills/ inside a project).
3. Start a new session. Claude Code loads the skill when your request matches.

Codex

1. Download the skill .zip.
2. Unzip it into ~/.agents/skills/ (or .agents/skills/ inside a project).
3. Codex picks it up on its own. Type $ and the skill name to use it, or just ask for the task.

Cursor

1. Download the Cursor rule (.mdc).
2. Save it in .cursor/rules/ inside your project.
3. Cursor's agent applies the rule when your request matches its description.

AGENTS.md (Codex, Cursor, and other coding agents)

1. Copy the AGENTS.md section.
2. Paste it into AGENTS.md at the root of your repository, creating the file if needed.
3. Coding agents that read AGENTS.md follow it when your request fits.