Skill

Security checker

Scans your code for common security mistakes such as exposed secrets, unsafe input handling and risky settings, and reports them by severity. Manual-only: run it with /security-checker.

Free For Claude Code

How to use it

Save the file below as .claude/skills/security-checker/SKILL.md in your project.
Run it in Claude Code with /security-checker.

SKILL.md

.claude/skills/security-checker/SKILL.md

---
name: security-checker
description: Reviews code for common security problems and reports them without changing anything.
disable-model-invocation: true
argument-hint: [file-or-folder]
---

Review $ARGUMENTS (if none is given, the current uncommitted changes, or otherwise the whole project).

Look for:

- Secrets in code or committed files: API keys, passwords, tokens, private keys.
- User input used unsafely: SQL built from strings, unescaped HTML, shell commands built from input, file paths taken from input.
- Missing checks on who is allowed to do something (login, permissions, ownership of records).
- Risky settings: debug mode left on, permissive CORS, disabled certificate checks, weak or home-made cryptography.
- Dependencies with known problems, if the package manager has an audit command you can run read-only.

For each finding give the file and line, what could go wrong in plain English, and the smallest fix. Label each High, Medium or Low. Say which findings you are unsure about.

Do not edit files. If you find a real secret, tell the user it should be revoked and replaced, and do not print the full value. This is a first pass, not a substitute for a professional security review.