security-review | aims-toolkit | ClaudePluginHub

Skill

Community

security-review

From aims-toolkit

0

Description

보안, 보안 리뷰, 보안 검토, 취약점, 보안 분석 - Use when reviewing code for security vulnerabilities, designing authentication/authorization, or ensuring secure architecture. Provides systematic security analysis based on OWASP guidelines.

AI Summary

Performs systematic security reviews using OWASP Top 10 guidelines. Triggers when reviewing code for vulnerabilities, designing authentication systems, or conducting pre-deployment security checks.

Install

1

Add the repository(one-time)

$

/plugin marketplace add aimskr/aims-toolkit

2

Install the plugin

$

/plugin install aims-toolkit@aims-toolkit

Tool Access

This skill is limited to using the following tools:

ReadWriteGrepGlobBashWebSearch

Supporting Assets

View in Repository

OWASP-CHECKLIST.md

Skill Content

Security Review Skill

Systematic workflow for security review and vulnerability analysis.

When to Use

Reviewing code for security vulnerabilities
Designing authentication/authorization systems
Establishing sensitive data handling practices
Pre-deployment security checklist verification

The Process

Phase 1: Security Scope Assessment

Codebase Analysis:

Identify authentication/authorization code
Map external input handling points
Trace sensitive data flow
Check external API integration points

Attack Surface Definition:

User input: forms, URL params, headers
File uploads: type, size, storage location
API endpoints: public/private, auth requirements
Database: query generation methods

Phase 2: OWASP Top 10 Check

Perform systematic check against OWASP Top 10 (2021):

A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable Components
A07: Authentication Failures
A08: Data Integrity Failures
A09: Logging Failures
A10: SSRF

For detailed checklist, code patterns, and search queries: Read OWASP-CHECKLIST.md in this skill directory.

Phase 3: Vulnerability Report

Severity Classification:

Level	Description	Response Time
🔴 Critical	Immediately exploitable, severe impact	Within 24h
🟠 High	Exploitable, significant impact	Within 1 week
🟡 Medium	Conditional exploit, limited impact	Within 1 month
🟢 Low	Hard to exploit, minimal impact	Next release

Phase 4: Security Design Recommendations

Provide recommendations for:

Authentication design (JWT, session management)
Authorization model (RBAC, ABAC)
Data encryption strategies
Secure coding practices

Key Principles

Zero Trust: Never trust any input
Defense in Depth: Multi-layer defense
Least Privilege: Minimum required permissions
Fail Secure: Safe state on failure
Security by Design: Consider security from design phase

Detailed Reference

For OWASP checklist, vulnerable code patterns, search queries, and report templates: Read OWASP-CHECKLIST.md in this skill directory.

Links

GitHub Stats

0 forks

Updated 1 day ago

Similar Skills

Command Development

This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.

53.4k

Agent Development

This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.

53.4k

Hook Development

This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.

53.4k