spec-driven-claude-code: Skill for Claude Code

Security Review Skill

Purpose

Systematically scan the codebase for security vulnerabilities and produce a prioritized report.

Boundary vs /scan: inside the /scan pipeline, do NOT run these tools manually — use the automation script .claude/scripts/scan-all.sh (per commands/scan.md Phase 0). This skill is the manual / ad-hoc variant for quick audits outside the pipeline.

Checklist

🔴 Critical (Check First)

• Hardcoded secrets, API keys, passwords in source files

  grep -rn --include="*.cs" --include="*.json" \
    -E "(password|secret|apikey|api_key|connectionstring)\s*[:=]\s*['\"][^'\"]{8,}" src/
  

• appsettings.json with real secrets committed

  git log --all --full-history -- "**/appsettings*.json"
  grep -rn "Password=" src/
  

• SQL injection via string concatenation (Dapper raw queries)

  grep -rn --include="*.cs" "ExecuteAsync\|QueryAsync" src/ | grep -v "@"
  grep -rn --include="*.cs" '\$".*SELECT\|INSERT\|UPDATE\|DELETE' src/
  

• Insecure deserialization

  grep -rn --include="*.cs" "JsonSerializer.Deserialize\|BinaryFormatter" src/
  

🟡 High Priority

• Missing [Authorize] on protected endpoints

  grep -rn --include="*.cs" "\[HttpGet\]\|\[HttpPost\]\|\[HttpPut\]\|\[HttpDelete\]" src/ | \
    grep -v "\[Authorize\]"
  

• Missing authorization checks (privilege escalation)
• Passwords stored without hashing

  grep -rn --include="*.cs" "Password\s*=" src/ | grep -v "PasswordHash\|HashPassword"
  

• JWT secrets too short or hardcoded

  grep -rn --include="*.cs" --include="*.json" "Jwt.*Secret" src/
  

• No rate limiting on auth endpoints

  grep -rn --include="*.cs" "\[HttpPost\].*login\|signin\|register" src/
  

• Missing FluentValidation on request DTOs

  # Check if validators exist for Request classes
  find src/ -name "*Request.cs" -exec basename {} \; | \
    while read f; do grep -l "${f%.*}Validator" src/ || echo "Missing: $f"; done