Pre-Commit Security Review and Fixes
Review edits, staged diffs, and risky commands for exploitable flaws, with precise fixes and targeted regression checks.
Before & after
Same prompt, same agent — the only difference is the skill.
I can review your code for security issues. There are a lot of common vulnerabilities to watch out for — SQL injection, cross-site scripting, authentication problems, data exposure, that kind of thing. I'd need to see the actual code changes to identify specific risks. It would help to know what framework you're using, what databases you're connecting to, and how you're handling authentication. Different types of vulnerabilities need different fixes. I could flag issues and suggest improvements, but you'd probably want to have security expertise on your team review anything critical before it goes live. Do you want me to focus on a particular part of your code or look at the full diff?
PRE-DEPLOYMENT SECURITY SCAN
OWASP A03:2021 — INJECTION (CRITICAL)
File: api/search.ts, Line 42
Vulnerability: User input passed directly to database query
const results = db.query("SELECT * FROM posts WHERE tags LIKE '" + userInput + "'")
Risk: Attacker input "'; DROP TABLE posts; --" destroys data
Fix: Use parameterized queries
db.query("SELECT * FROM posts WHERE tags LIKE ?", userInputParam)
Impact: Critical — stop deployment until fixed
OWASP A01:2021 — BROKEN ACCESS CONTROL (HIGH)
File: api/user-admin.ts, Line 67
Vulnerability: Admin check missing on endpoint
app.delete("/user/:id", (req, res) => { /* no role check */ })
Risk: Any user can delete any other user
Fix: Add auth middleware
app.delete("/user/:id", requireAdmin, (req, res) => { ... })
Impact: High — review before deploy
OWASP A02:2021 — CRYPTOGRAPHIC FAILURE (MEDIUM)
File: auth.ts, Line 15
Issue: Passwords hashed with MD5 (weak, rainbow-table vulnerable)
Fix: Use bcrypt or argon2
const hash = await bcrypt.hash(password, 12)
Impact: Medium — scheduled for next sprint
REPORT: 1 Critical, 1 High, 1 Medium found. Deploy blocked until Critical resolved.About this skill
Your change looks small, but it can still expose another account's records, turn input into a shell command, or commit a live credential. This skill reviews proposed edits, staged changes, and sensitive commands, then explains which risks need fixing before you proceed. Findings include the vulnerable path, a practical repair, and a check that would catch the same mistake again.
What it does
- Reviews the exact proposed change or staged diff, including relevant callers, middleware, configuration, and deleted protections.
- Traces untrusted input through validation and authorization to database, shell, filesystem, network, and browser operations.
- Separates demonstrated vulnerabilities from unresolved questions and optional hardening.
- Checks commands for credential exposure, destructive scope, remote code execution, and production impact before execution.
- Produces minimal fixes and regression checks tied to the actual exploit mechanism.
- Maps supported findings to CWE and, when requested, a named OWASP framework and edition.
What you get
A scoped security review with a proceed, fix-before-proceeding, or unresolved decision. Each actionable finding includes evidence, exploit conditions, severity, remediation, and verification status; authorized code changes can be repaired and checked when tools are available.
Best for
Developers using Claude to edit application code, prepare commits, or run sensitive development commands, especially around authentication, account data, secrets, uploads, and external integrations.
SKILL.md preview
---
name: pre-commit-security-review-and-fixes
description: Review proposed edits, staged commits, and sensitive commands by tracing trust boundaries, proving exploit conditions, and supplying minimal fixes with targeted regression checks. Use when the user says "check this before I commit", "review this diff for security", "is this command safe to run?", "watch for security issues while editing", "my API keeps exposing other users' data", "did I leak a secret?", or "fix the security problems in this change".
---
# Pre-Commit Security Review and Fixes
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.