Made by@slashcloneSecurity audit for your web app before launch
@slashclone/security-review-checklist
Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.
SkillDevOpsv0.1.0
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
No permission changes between 0.1.0 and 0.1.1.
SKILL.md
1 added, 1 removed
| @@ line 1 → 1 | ||
| 1 | 1 | --- |
| 2 | 2 | name: security-review-checklist |
| 3 | Removed: description: Run a structured security review of a web app plus its API, OAuth server, MCP connector or CLI, and anything that installs or runs user-supplied files. Use before a launch, after a big feature, or when someone asks for a full audit. Produces a threat model, architecture notes, and numbered findings with severity, fix, and verification. | |
| 3 | Added: description: "Run a structured security review of a web app plus its API, OAuth or SSO, MCP connector or CLI, and anything that uploads, installs, or runs user-supplied files. Produces architecture notes, a threat model, and numbered findings with severity, fix, and verification, written only to the review docs folder; reads code and runs signed-out checks, never changes application code. Use when someone asks for a security audit, a pentest-style review, \"is my app secure?\", a pre-launch security check, or a review after a big feature." | |
| 4 | 4 | --- |
| 5 | 5 | |
| 6 | 6 | # Security review checklist |
kit.json
12 added, 5 removed
| @@ line 1 → 1 | ||
| 1 | 1 | { |
| 2 | 2 | "name": "security-review-checklist", |
| 3 | 3 | "owner": "slashclone", |
| 4 | Removed: "version": "0.1.0", | |
| 4 | Added: "version": "0.1.1", | |
| 5 | 5 | "type": "skill", |
| 6 | Removed: "description": "Run a structured security review of a web app and its API, OAuth server, MCP connector or CLI, and any path that installs or runs user-supplied files. Writes a threat model, architecture notes, and numbered findings with severity, fix, and how each fix was verified. Reads the code, never changes it, and writes only to the review docs folder.", | |
| 6 | Added: "title": "Security audit for your web app before launch", | |
| 7 | Added: "description": "Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.", | |
| 7 | 8 | "category": "devops", |
| 8 | 9 | "license": "MIT", |
| 9 | Removed: "compat": ["claude-code"], | |
| 10 | Added: "compat": [ | |
| 11 | Added: "claude-code" | |
| 12 | Added: ], | |
| 10 | 13 | "permissions": { |
| 11 | 14 | "files": { |
| 12 | Removed: "read": ["**"], | |
| 13 | Removed: "write": ["docs/security-review/**"] | |
| 15 | Added: "read": [ | |
| 16 | Added: "**" | |
| 17 | Added: ], | |
| 18 | Added: "write": [ | |
| 19 | Added: "docs/security-review/**" | |
| 20 | Added: ] | |
| 14 | 21 | } |
| 15 | 22 | } |
| 16 | 23 | } |