mcp-security-review

Perform a pre-coding security review for the following task:

Perform a threat model for the following feature or component:

Perform a security review of the following code:

Pre-coding security assessment for any development task. Use this skill whenever the user is about to start coding a feature and wants to know the security requirements, risks, or considerations first — even if they don't say "security review" explicitly. Trigger on phrases like "before I code this", "what are the security requirements for", "security considerations for", "is this secure to build", "what should I watch out for when building", or when a user describes a feature (login, payments, file upload, API, auth, etc.) and asks how to approach it safely. Also trigger when user asks to "vibe code" securely or mentions they want security built in from the start.

Threat modeling for a feature, component, or system. Use this skill whenever the user wants to think through what could go wrong security-wise with something they're building, asks "what are the security threats for", "threat model this", "what attacks should I worry about", "help me think through the security of", or is designing a new feature and wants to identify risks before coding. Also trigger for phrases like "attack surface", "what can an attacker do", "security design review", or when building something involving auth, payments, file handling, multi-tenancy, external APIs, or sensitive data flows. This produces a concrete, developer-friendly threat model — not abstract frameworks — with actionable mitigations and an optional threat-model.md file.

Security review of code for vulnerabilities. Use this skill whenever the user wants to check code for security issues, asks "is this code secure?", "review this for vulnerabilities", "any security issues here?", or pastes code and asks for feedback. Also trigger when the user has just finished coding a feature (especially auth, APIs, file handling, database queries, or anything that handles user input) and wants to verify it before shipping. Trigger on phrases like "review the code", "check for vulnerabilities", "audit this", "is this safe?", "security check on this", or after generating code with an AI and wanting to validate it. Works with any language: Python, JavaScript, TypeScript, Java, Go, Ruby, SQL, etc.