Pre-Merge Code Security Review
Review code changes for exploitable security flaws, with evidence, targeted fixes, and regression tests before merge.
Before & after
Same prompt, same agent — the only difference is the skill.
Code security is important before deployment. Common issues to watch for include injection vulnerabilities, authentication problems, and unsafe data handling. You'd want to review input validation, check authorization logic, and verify that sensitive data isn't being logged or stored improperly. SQL injection and cross-site scripting are frequent concerns. You should also check for hardcoded secrets. Would you like me to review a specific file or section of code?
SECURITY SCAN RESULTS
SEVERITY: HIGH
Issue: SQL query concatenation on line 47
Code: const query = 'SELECT * FROM users WHERE id = ' + userId;
Fix: Use parameterized queries—const query = 'SELECT * FROM users WHERE id = $1';
CVE Class: SQL Injection
SEVERITY: MEDIUM
Issue: Auth token stored in localStorage (line 23)
Code: localStorage.setItem('token', jwtToken);
Fix: Use httpOnly cookie instead; localStorage is vulnerable to XSS
CVE Class: Cross-Site Scripting
SEVERITY: MEDIUM
Issue: API key visible in error logs (line 15)
Code: console.error('API key: ' + process.env.STRIPE_KEY);
Fix: Never log secrets; use redaction middleware
CVE Class: Information Disclosure
SEVERITY: LOW
Issue: Missing input validation on email field
Fix: Add email regex check or use validator library
SCAN COMPLETE: 4 issues found. 3 require fix before merge.About this skill
A security review that flags every suspicious function leaves you sorting warnings while the real authorization bug ships. This skill follows changed inputs to sensitive operations, checks who can access each resource, and reports exploitable paths with enough evidence to fix them before merge.
What it does
- Maps changed endpoints, jobs, handlers, and configuration to the trust boundaries they affect.
- Traces attacker-controlled values into database queries, commands, templates, file operations, and outbound requests.
- Checks resource ownership, tenant isolation, role enforcement, and writable fields beyond basic login checks.
- Reviews secret handling, sensitive responses, session changes, uploads, and security-relevant defaults.
- Separates demonstrated findings from unresolved questions and unrelated existing weaknesses.
- Supplies targeted remediation and regression tests that exercise the actual attack path.
What you get
A concise merge recommendation and prioritized findings with code locations, attacker prerequisites, impact, fixes, and proposed tests. The review states what was inspected and which protections remain unverified.
Best for
Developers and reviewers checking pull requests, AI-generated changes, new endpoints, authentication changes, or sensitive data flows before merge.
SKILL.md preview
---
name: pre-merge-code-security-review
description: Review code changes for exploitable injection, authorization, and sensitive-data flaws by tracing attacker-controlled inputs across trust boundaries to sensitive operations. Use when the user says "review this diff for security", "is this PR safe to merge?", "check this new endpoint", "my API lets users see other accounts", "scan this AI-generated code", "look for injection bugs", or "check these authentication changes".
---
# Pre-Merge Code Security Review
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.