Security PR review

A defensive pass for a pull request: injection, broken auth, secrets, SSRF, unsafe deserialization. Complements Cursor’s Security Review bot; this file is what the agent in the editor should follow.

Loaded on demand when the task matches the description.

Install path

.cursor/skills/security-pr-review/SKILL.md

---
name: security-pr-review
description: Review a diff for exploitable bugs and patch the ones you find. Use on pull requests, uncommitted work, or when the user asks for a security pass. Do not write exploits or PoCs.
icon: lock
color: red
---

# Security PR review

Style and quality stay with other reviews. This pass is only for bugs an attacker could use.

## Scope

Trace where untrusted input enters and what it passes through. Look for:

- Injection on SQL, command, template, and LDAP surfaces
- Authentication or authorization that is missing, or that a refactor stopped running
- Secrets and credentials committed to source
- SSRF and unvalidated redirects
- Unsafe deserialization
- Dependency changes that pull in known vulnerabilities
- Insecure defaults in infra or config

## Steps

1. Read the diff in the context of the surrounding files. Do not review a string in isolation.
2. For each finding, write: severity, the attack path in one sentence, and a proposed fix in this repo.
3. Patch the findings the user wants fixed. Prefer parameterized queries, deny-by-default authz, and removing the secret from git history when it was committed.
4. Dismiss noise with a reason. Do not pad the review with style nits.

## Do not

- Write an exploit, a PoC payload, or reproduction steps that attack a system
- File “could theoretically” issues with no path from user input
- Duplicate Bugbot-style copy or layout comments

## Done when

Each finding is either patched or dismissed with a reason a security engineer would accept.