/security-review
Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge.
$ npx -y skills add ktnyt/cclsp --skill security-review --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/security-review
Context preview
The summary Claude sees to decide when to auto-load this skill.
Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge.
SKILL.md
security-review.SKILL.mdname: security-review
description: >-
Request a security expert assessment for code changes that touch child process
spawning, file system access, configuration loading, or environment variable
handling. Use when the Reviewer identifies security-sensitive changes in the
MCP-LSP bridge.
compatibility: Designed for Claude Code (or similar products)
metadata:
author: ktnyt
version: "1.0"
Security Review
Invoke the security-reviewer agent to assess security-sensitive changes.
When to trigger
- Child process spawning or lifecycle changes (`src/lsp-client.ts`)
- File system read/write operations (`src/file-editor.ts`, `src/file-scanner.ts`)
- Configuration file loading or parsing (`cclsp.json`, `CCLSP_CONFIG_PATH`)
- Environment variable handling
- New or modified LSP server adapter (`src/lsp/adapters/`)
- Setup wizard input handling (`src/setup.ts`)
Review checklist
1. **Command injection**: Are user-supplied values (config file paths, server commands) sanitized before being passed to `child_process` spawn? 2. **Path traversal**: Can file paths from LSP responses escape the project root? Are `file://` URIs validated before resolving? 3. **Resource exhaustion**: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth? 4. **Config trust boundary**: Is `cclsp.json` treated as trusted input? What happens if it contains unexpected fields or types? 5. **Process cleanup**: Are child processes reliably terminated on shutdown? Can orphaned processes persist? 6. **Symlink attacks**: Does file resolution follow symlinks outside the project directory?
How to invoke
Use the `everything-claude-code:security-reviewer` agent via the Task tool:
Task(
subagent_type: "everything-claude-code:security-reviewer",
prompt: "Review the following changes for security concerns: <describe changes>"
)
Output expectations
The security reviewer should produce:
- **CRITICAL**: Must fix before merge (injection, traversal, credential leak)
- **HIGH**: Should fix before merge (missing timeouts, incomplete cleanup)
- **MEDIUM**: Fix when possible (defensive checks, hardening opportunities)
- **LOW**: Informational (best practice suggestions)
Read more
name: security-review description: >- Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge. compatibility: Designed for Claude Code (or similar products) metadata: author: ktnyt version: "1.0"
Security Review
Invoke the security-reviewer agent to assess security-sensitive changes.
When to trigger
- Child process spawning or lifecycle changes (`src/lsp-client.ts`)
- File system read/write operations (`src/file-editor.ts`, `src/file-scanner.ts`)
- Configuration file loading or parsing (`cclsp.json`, `CCLSP_CONFIG_PATH`)
- Environment variable handling
- New or modified LSP server adapter (`src/lsp/adapters/`)
- Setup wizard input handling (`src/setup.ts`)
Review checklist
1. **Command injection**: Are user-supplied values (config file paths, server commands) sanitized before being passed to `child_process` spawn? 2. **Path traversal**: Can file paths from LSP responses escape the project root? Are `file://` URIs validated before resolving? 3. **Resource exhaustion**: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth? 4. **Config trust boundary**: Is `cclsp.json` treated as trusted input? What happens if it contains unexpected fields or types? 5. **Process cleanup**: Are child processes reliably terminated on shutdown? Can orphaned processes persist? 6. **Symlink attacks**: Does file resolution follow symlinks outside the project directory?
How to invoke
Use the `everything-claude-code:security-reviewer` agent via the Task tool:
Task( subagent_type: "everything-claude-code:security-reviewer", prompt: "Review the following changes for security concerns: <describe changes>" )
Output expectations
The security reviewer should produce:
- **CRITICAL**: Must fix before merge (injection, traversal, credential leak)
- **HIGH**: Should fix before merge (missing timeouts, incomplete cleanup)
- **MEDIUM**: Fix when possible (defensive checks, hardening opportunities)
- **LOW**: Informational (best practice suggestions)
cclsp is a Model Context Protocol (MCP) server that seamlessly integrates LLM-based coding agents with Language Server Protocol (LSP) servers.
Repo: ktnyt/cclsp
Other skills on cclsp.
- /architecture
Guides the design of safely disposable code through contracts (traits/interfaces) and dependency inversion. Use when designing new modules, refactoring existing code, or making architectural decisions about component boundaries.
Open skill - /hands-on-test
Performs manual hands-on testing of a web application using playwright-cli. Spawns the dev server if needed, navigates to pages, performs browser actions, captures screenshots, checks outcomes, and produces a structured test report. Use when the user wants to visually verify a
Open skill - /playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Open skill