Awesome-claude-code s6-security-review

Run a security-focused code review identifying vulnerabilities

install

source · Clone the upstream repo

git clone https://github.com/pgagarinov/awesome-claude-code

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/pgagarinov/awesome-claude-code "$T" && mkdir -p ~/.claude/skills && cp -r "$T/examples/05-skills-n-agents/.claude/skills/s6-security-review" ~/.claude/skills/pgagarinov-awesome-claude-code-s6-security-review && rm -rf "$T"

manifest: examples/05-skills-n-agents/.claude/skills/s6-security-review/SKILL.md

source content

S6 — Security Review

Perform a security-focused review of: $ARGUMENTS

If no target is specified, review the entire codebase.

Review Checklist

Critical — Check for These First

Hardcoded Secrets: API keys, tokens, passwords in source code
Injection Vulnerabilities: SQL injection, command injection, code injection
Insecure Authentication: Weak comparison, missing rate limiting, plain-text passwords
Input Validation Gaps: Unvalidated user input passed to sensitive operations

High Priority

Unsafe Deserialization:
```
pickle.loads
```
,
```
yaml.load
```
without SafeLoader
Path Traversal: User input in file paths without sanitization
Information Disclosure: Stack traces, debug info, verbose error messages
Missing Access Control: Operations without authorization checks

Medium Priority

Timing Attacks: String comparison of secrets using
```
==
```
instead of
```
hmac.compare_digest
```
Dependency Issues: Known vulnerable packages, unpinned versions

Report Format

For each finding, report:

[SEVERITY: CRITICAL/HIGH/MEDIUM/LOW] Title
  File: file_path:line_number
  Issue: What the vulnerability is
  Impact: What an attacker could do
  Fix: How to remediate

End with a severity summary and prioritized fix list.