Security Review Skill | Agent Skills

Security Review

Exclusive to: security-expert agent

MCP Helpers (Brain + Memory + Web)

🧠 Gemini-Bridge — Security Analysis

mcp_gemini-bridge_consult_gemini(query="Security audit this code for OWASP vulnerabilities: [code snippet]", directory=".")

🌉 Open-Bridge — Alternative Security Analysis

mcp_open-bridge_consult_gemini(query="Security audit this code for OWASP vulnerabilities: [code snippet]", directory=".")

💻 Codex-Bridge — Code Security Review

mcp_codex-bridge_consult_codex(query="Find security vulnerabilities in: [code]", directory=".")

📚 Context7 (Memory) — Up-to-Date Docs

Lookup security patterns and vulnerability mitigations:

mcp_context7_resolve-library-id(libraryName="laravel", query="csrf protection")
mcp_context7_query-docs(libraryId="/laravel/docs", query="authentication security")

🌐 Web Search — CVE and Vulnerability Lookup

mcp_web-search-prime_search(query="[package name] CVE vulnerability 2025")

Validation Loop (MANDATORY)

Every security review MUST run these dependency checks:

composer audit            # Check PHP vulnerabilities
npm audit                 # Check JS vulnerabilities
php artisan route:list --compact  # Verify route middleware

Report any vulnerabilities found as Critical findings.

Instructions

Run git diff to identify changed files
Scan for security vulnerabilities using checklist below
Check authentication and authorization patterns
Review input validation and sanitization
Report findings by severity (Critical → Warning → Suggestion)

OWASP Top 10 Checklist

| # | Vulnerability | Laravel Check | React Check | |---|---------------|---------------|-------------| | A01 | Broken Access Control | Policies, Gates | Route guards | | A02 | Cryptographic Failures | Hash::make, encrypt | No secrets in client | | A03 | Injection | Eloquent, query builder | No dangerouslySetInnerHTML | | A04 | Insecure Design | Business logic review | Component security | | A05 | Security Misconfiguration | .env settings | Build config | | A06 | Vulnerable Components | composer audit | npm audit | | A07 | Auth Failures | Rate limiting, sessions | Token handling | | A08 | Data Integrity | CSRF, mass assignment | Form validation | | A09 | Logging Failures | Security event logs | Error boundaries | | A10 | SSRF | URL validation | API call validation |

Laravel Security Checks

// Mass Assignment
$fillable = ['name', 'email'];  // ✅ Whitelist
$guarded = ['id', 'is_admin'];  // ✅ Blacklist

// SQL Injection Prevention
User::where('email', $email)->first();  // ✅ Safe
DB::raw("SELECT * FROM users WHERE email = '$email'");  // ❌ Dangerous

// CSRF
@csrf  // ✅ In forms

React Security Checks

// XSS Prevention
<div>{userInput}</div>  // ✅ Auto-escaped
<div dangerouslySetInnerHTML={{__html: userInput}} />  // ❌ XSS risk

// No secrets in client
const API_KEY = process.env.NEXT_PUBLIC_API_KEY;  // ⚠️ Visible to users

Audit Commands

composer audit          # PHP vulnerabilities
npm audit               # JS vulnerabilities
php artisan route:list  # Check route middleware

Examples

"Security review this PR"
"Check for OWASP vulnerabilities"
"Audit authentication flow"

Agent Skills: Security Review

Install this agent skill to your local

Skill Files